Mimikatz Activity Detection

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•3

Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.