PowerShell Credential Access Tools Detection

Ethan Andrews@eandrews

•updated Jun 9, 2026•5•0•7

This rule detects explicit references to popular PowerShell credential dumping tools, specifically 'Invoke-Mimikatz' and 'Invoke-Kerberoast', within executed PowerShell commands. It leverages native Defender XDR PowerShell command logging to identify these suspicious activities, which are indicative of credential access attempts.