Mimikatz DCSync credential dumping via lsadump::dcsync

Ibrahim Saud@tektrix

•updated Jul 2, 2026•4•0•11

Detects the execution of Mimikatz with command line arguments indicative of credential dumping, specifically DCSync attacks or dumping LSASS memory for passwords. The rule filters out processes signed by Microsoft to reduce noise.