Mimikatz sekurlsa lsass Dump Command Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the string "sekurlsa" within the HTTP URI, which is commonly associated with the Mimikatz tool attempting to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. The detection is case-insensitive and targets traffic flowing from the client to the server.