Mimikatz Credential Dumping via sekurlsa::logonpasswords or LSASS Access

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

This rule detects the execution of Mimikatz or the use of its specific command-line arguments, which are strongly indicative of credential dumping activities, often used for post-exploitation lateral movement or privilege escalation.