BIOC
High
✕
Command-line arguments match Mimikatz execution
These command-line arguments are often used by Mimikatz to dump credentials.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003)
Indicator:
Process action type = execution AND target process cmd = *privilege::debug* , *sekurlsa* , *kerberos::tgt* , *logonpasswords* , *kerberos::ptt* , *kerberos::golden* , *kerberos::list*
Preventable: yes