CL-STA-1062 Mimikatz Credential Dumping via sekurlsa::logonpasswords

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects execution of Mimikatz or the use of specific Mimikatz command-line arguments (e.g., 'sekurlsa::logonpasswords', 'privilege::debug') indicative of credential dumping, a common technique for harvesting plaintext credentials or hashes from LSASS memory.