Mimikatz LSASS Credential Dump via Renamed Binary or Known Arguments

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects Mimikatz-based credential dumping against the Local Security Authority Subsystem Service (LSASS) process. The rule identifies this activity by monitoring for renamed or known Mimikatz binary names, execution of specific credential-harvesting command-line arguments (such as sekurlsa::logonpasswords or privilege::debug), output redirection to credential-related files, or the loading of the Mimikatz kernel driver (mimidrv.sys).