Invoke-Mimikatz Credential Dumping Under Spoofed TiWorker.exe Identity
Detects process creation events where a process reported as TiWorker.exe (a trusted Windows servicing process) carries a command line containing Invoke-Mimikatz or Mimikatz command modules, indicating the process identity has been spoofed via a Silo-Binding bind-link mapping TiWorker.exe to PowerShell to evade AV/EDR script-blocking controls.
Sigma
