Mimikatz Execution and LSASS Access Detection

Kenji Choy@kchoy

•updated Apr 25, 2026•18•0•383

This rule identifies various indicators of Mimikatz execution, including specific command-line arguments, file names, suspicious access to the LSASS process memory, and the creation or loading of malicious services or DLLs associated with Mimikatz. It aims to detect credential dumping activities and persistence mechanisms often employed by attackers.