All Detections

Mimikatz driver registration (Reg via Sysmon)

SIGMA Detection Rules@SIGMADetectionRules
updated Sep 6, 2025011

Detects scenarios where an attacker installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.

Sigma