Credential Theft Tool Command Line Detection

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•4

This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.