Mimikatz Credential Dumping via sekurlsa::logonpasswords or privilege::debug

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

This rule detects the execution of Mimikatz via process name matching or the presence of known credential dumping command-line arguments (e.g., 'sekurlsa::logonpasswords' or 'privilege::debug'). These indicators are commonly used by adversaries to extract sensitive information like plaintext passwords or hashes from the LSASS memory process.