Windows Process Creation: Detect Mimikatz Tool and Module Command-Line Usage
Flags Windows processes whose command lines contain Mimikatz names and credential-dumping module/function arguments.
- Product
- windows
- Category
- process_creation
- Author
- Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton (SigmaHQ), DRL 1.1
- Published
- 2019-10-22
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line contains Mimikatz-related tool strings such as "mimikatz" or "DumpCreds". It also matches common Mimikatz module invocations and keywords (e.g., module/function markers like "::" and actions such as "sekurlsa::", "lsadump::", "token::", "dpapi::"). This matters because credential-dumping tools often leave distinctive command-line artifacts that defenders can spot in process telemetry. The detection relies on command line fields captured at process start.
Reporting behind it
- slideshare.nethttps://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- tools.thehacker.recipeshttps://tools.thehacker.recipes/mimikatz/modules
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Detect Mimikatz Tool and Module Command-Line Usage"
id: 7bbb777d-78d5-4af4-8582-7f43dcec4d30
status: test
description: This rule flags Windows process creation events where the command line contains Mimikatz-related tool strings such as "mimikatz" or "DumpCreds". It also matches common Mimikatz module invocations and keywords (e.g., module/function markers like "::" and actions such as "sekurlsa::", "lsadump::", "token::", "dpapi::"). This matters because credential-dumping tools often leave distinctive command-line artifacts that defenders can spot in process telemetry. The detection relies on command line fields captured at process start.
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://tools.thehacker.recipes/mimikatz/modules
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml
author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton, Huntrule Team
date: 2019-10-22
modified: 2023-02-21
tags:
- attack.credential-access
- attack.t1003.001
- attack.t1003.002
- attack.t1003.004
- attack.t1003.005
- attack.t1003.006
logsource:
category: process_creation
product: windows
detection:
selection_tools_name:
CommandLine|contains:
- DumpCreds
- mimikatz
selection_function_names:
CommandLine|contains:
- ::aadcookie
- ::detours
- ::memssp
- ::mflt
- ::ncroutemon
- ::ngcsign
- ::printnightmare
- ::skeleton
- ::preshutdown
- ::mstsc
- ::multirdp
selection_module_names:
CommandLine|contains:
- "rpc::"
- "token::"
- "crypto::"
- "dpapi::"
- "sekurlsa::"
- "kerberos::"
- "lsadump::"
- "privilege::"
- "process::"
- "vault::"
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: a642964e-bead-4bed-8910-1bb4d63e3b4d
type: derived