Mimikatz LSASS Credential Dumping via sekurlsa or Renamed Variants

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects known credential dumping activity, specifically focusing on the execution of Mimikatz (or renamed variants) and the use of built-in system tools like comsvcs.dll or procdump to dump lsass.exe process memory.