Mimikatz Execution via mimikatz.exe or sekurlsa::logonpasswords Command

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•2

Detects the execution of mimikatz.exe or the usage of the sekurlsa::logonpasswords command, both of which are indicative of attempts to extract sensitive credentials from LSASS memory.