Mimikatz Keywords in Windows Event Logs

Daniel Jeremiah@daniyyell

•updated Jun 4, 2026•0•64

The rule detects the use of Mimikatz by searching for specific keywords within Windows event logs. These keywords include Mimikatz module commands (e.g., 'dpapi::masterkey', 'kerberos::golden', 'lsadump::', 'sekurlsa::'), artifacts associated with Mimikatz (e.g., 'mimidrv.sys', 'mimilib.dll'), and PowerShell commands commonly used with Mimikatz (e.g., 'Invoke-Mimikatz', 'Invoke-Mimikittenz'). The detection logic specifically excludes events with EventID 15.