Mimikatz execution or LSASS credential access following AD/SMB discovery
Detects execution of Mimikatz or LSASS process memory credential theft techniques that are preceded by common discovery tools (such as nltest, net, adcmd, netexec, or kerbrute) on the same device within a 24-hour window.
Microsoft Sentinel (KQL)
