Mimikatz Credential Dumping via LSASS Access or sekurlsa Modules

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•5

This rule detects the execution of Mimikatz or the use of its common command-line arguments, which are indicative of credential dumping and post-exploitation activities. It monitors process creation events for the 'mimikatz.exe' binary or command-line patterns associated with credential theft techniques such as dumping LSASS memory, extracting passwords, or Kerberos ticket manipulation.