Credential Dumping from LSASS via Mimikatz (sekurlsa::logonpasswords)
This rule detects the execution of the Mimikatz credential dumping tool by monitoring for specific process names or command-line arguments, including the use of 'sekurlsa' modules to harvest credentials from memory. Mimikatz is widely used by adversaries to perform credential theft, including dumping passwords, hashes, and Kerberos tickets from memory.
Cortex XDR
