Detection of Mimikatz Credential Dumping Activity

Mimikatz is a widely utilized post-exploitation tool designed for credential harvesting, pass-the-hash attacks, and privilege escalation on Windows systems. Threat actors frequently employ Mimikatz to extract cleartext passwords, hashes, PINs, and Kerberos tickets from LSASS memory. The tool is known for its modular architecture, allowing attackers to perform actions such as clearing event logs, interacting with the DPAPI master keys, and injecting malicious payloads into system processes. This brief highlights specific keyword signatures associated with various Mimikatz modules that, when observed in system event logs, strongly indicate unauthorized credential access or lateral movement preparation. Defenders should prioritize monitoring for these strings, particularly when they originate from processes not associated with legitimate administrative activity or security software updates.

Impact

Successful execution of Mimikatz allows attackers to gain unauthorized access to credentials stored on a compromised endpoint. This impact typically leads to account takeover, lateral movement across the network, and the escalation of privileges to Domain Admin level. The exfiltration of credentials enables long-term persistence, often resulting in widespread data theft or the deployment of ransomware.

Recommendation

• Deploy the Sigma rules provided in this brief to your SIEM to monitor for known Mimikatz command-line arguments and file artifacts in system logs.
• Configure Sysmon to capture process creation and file creation events, ensuring broad visibility into the execution of tools that attempt to interact with lsass.exe.
• Tune detection alerts to exclude legitimate security tooling and administrative scripting paths to reduce false positive fatigue.
• Investigate any alerts triggered by these signatures immediately, focusing on the parent process and user context to determine if the activity is authorized.