BIOC
Medium
✕
PowerShell runs with known Mimikatz arguments
These PowerShell arguments are often used to run commands with malicious intent while running Mimikatz, a credential harvesting tool.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Collection
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003)
Indicator:
Process action type = execution AND target process cmd = *privilege::* , *sekurlsa::* , *kerberos::* , *crypto::* , *vault::* , *token::* , *lsadump::* , *-dumpcr* , *-dumpce* AND target process name = powershell.exe
Preventable: yes