Mimikatz LSASS Access via Suspicious GrantedAccess or Renamed Mimikatz Binary

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects unauthorized or suspicious attempts to access the memory space of the Local Security Authority Subsystem Service (LSASS) process. The detection logic looks for specific access masks typically used by Mimikatz (0x1010 and 0x1fffff) or execution attempts from binaries renamed to mimic common Mimikatz naming conventions (g.com, hs.com, dump.com). This is intended to identify credential dumping activities.