Mimikatz LSASS Credential Dump via Renamed Binaries and mimidrv.sys

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects execution of Mimikatz or usage of common tools like Procdump to dump LSASS memory. The rule monitors for characteristic command-line arguments, renamed binary names associated with Mimikatz, and the extraction of sensitive credentials to output files.