Analytics BIOC
High
✕
Mimikatz command-line arguments
These command-line arguments are often used by Mimikatz to dump and harvest credentials.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003)
Attacker's goals:
An attacker is attempting to use Mimikatz, a known credential theft tool, to dump and harvest credentials.
Investigative actions:
Investigate the executed process to verify if it is malicious. Investigate the command line purpose.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day