Mimikatz Execution with LSASS Memory Access Alongside NirSoft Toolkit

Duo Tech@duotech

•updated Jul 13, 2026•1•0•5

Detects the execution of the Mimikatz credential dumping tool, either as the initiating process or the action process, indicating potential credential theft attempts.