Mimikatz Process Execution Detection
This rule detects the execution of the Mimikatz tool by looking for the string "mimikatz" (case-insensitive) in the command line of newly launched processes. Mimikatz is a well-known credential dumping tool often used by adversaries to extract plaintext passwords, hash, PIN codes, and Kerberos tickets from memory.
YARA-L
