• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Mimikatz Use

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    SigmaHQ Detections@sigmaHQ
    •updated Jan 5, 2022•0•0•0

    This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

    Sigma

    Tags

    S0002 - MimikatzTA0008 - Lateral MovementTA0006 - Credential AccessT1003.002 - Security Account ManagerT1003.004 - LSA SecretsT1003.001 - LSASS MemoryT1003.006 - DCSyncCredential DumpingCredential AccessWindowsWindows SysmonWindows Eventlog SecurityWindows Eventlog ApplicationWindows Eventlog Systemattack.s0002attack.lateral-movementattack.credential-accesscar.2013-07-001car.2019-04-004attack.t1003.002attack.t1003.004attack.t1003.001attack.t1003.006

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?