Mimikatz LSASS Credential Dumping via sekurlsa::logonpasswords

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

Detects the execution of Mimikatz or the use of specific Mimikatz command-line arguments intended to extract credentials from LSASS memory, a common technique for credential harvesting during post-exploitation activities.