Mimikatz LSASS Credential Dumping via sekurlsa

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•3

This rule monitors for credential dumping activities by identifying the execution of Mimikatz, the use of command-line arguments specific to Mimikatz (e.g., 'sekurlsa'), or unauthorized processes attempting to access the Local Security Authority Subsystem Service (LSASS) process.