Mimikatz LSASS Credential Dumping (sekurlsa::logonpasswords)
Detects the execution of Mimikatz or the use of specific command-line arguments (e.g., sekurlsa::logonpasswords) known for extracting sensitive credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule monitors both process creation command lines and raw process memory read operations targeted at lsass.exe.
Microsoft Sentinel (KQL)
