Mimikatz Command Line Execution
This rule detects the execution of Mimikatz or Mimikatz-like tools by looking for specific command-line arguments commonly used by the tool. Mimikatz is a well-known post-exploitation tool used to extract plaintext passwords, hash, PIN codes, and Kerberos tickets from memory, particularly from the Local Security Authority Subsystem Service (LSASS) process. The rule identifies various Mimikatz modules and commands such as "dumpcreds", "mimikatz", "::aadcookie", "::detours", "::memssp", "::mflt", "::ncroutemon", "::ngcsign", "::printnightmare", "::skeleton", "::preshutdown", "::mstsc", "::multirdp", "rpc::", "token::", "crypto::", "dpapi::", "sekurlsa::", "kerberos::", "lsadump::", "privilege::", "process::", and "vault::". Detection of these arguments indicates an attempt to perform credential access or privilege escalation.
YARA-L
