Mimikatz LSASS Credential Dumping via sekurlsa::logonpasswords

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•11

Detects attempts to dump credentials from the LSASS process memory, either by executing known credential dumping tools like Mimikatz, using command-line arguments indicative of credential harvesting, or performing suspicious memory access/dumping operations on the lsass.exe process.