skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-mimikatz-execution-patterns

Detect Mimikatz credential dumping via LSASS access, command-line, and in-memory indicators.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#mimikatz#sysmon#credential dumping#mitre attack#LSASS
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-mimikatz-execution-patterns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-mimikatz-execution-patterns
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-mimikatz-execution-patterns
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-mimikatz-execution-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Credential dumping with Mimikatz is a core step in Windows intrusions, yet naive string and hash signatures are trivially evaded by renamed binaries and in-memory execution. This Skill guides threat hunters to the durable signals — LSASS process access, LOLBin dump commands, and memory artifacts — so detections survive attacker evasion.

Core Features & Use Cases

  • Durable LSASS access detection: Hunt Sysmon Event ID 10 ProcessAccess events targeting lsass.exe with suspicious GrantedAccess masks like 0x1010 or 0x1fffff.
  • LOLBin and dump-file coverage: Detect rundll32 comsvcs.dll MiniDump, procdump, and Task Manager dump creation that bypass Mimikatz artifacts entirely.
  • Validation and tuning guidance: Verify rules fire with procdump tests and tune false positives from AV, backup, and DLP agents.
  • Use Case: During a purple team exercise, run procdump -ma lsass.exe and confirm both the EID 10 GrantedAccess query and the comsvcs/dmp query trigger in your SIEM.

Quick Start

Hunt for Mimikatz credential dumping on our Windows fleet by querying Sysmon Event ID 10 for suspicious LSASS access and checking for comsvcs.dll MiniDump command lines.

Frequently Asked Questions about detecting-mimikatz-execution-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Mimikatz credential dumping on Windows?▼

Hunt Sysmon Event ID 10 ProcessAccess events targeting lsass.exe with GrantedAccess values like 0x1010, 0x1410, 0x143a, or 0x1fffff from non-system processes. Also monitor command lines for rundll32 comsvcs.dll MiniDump and procdump -ma lsass.exe.

Why do Mimikatz hash and string signatures fail to detect attacks?▼

Renamed binaries, in-memory execution via Invoke-Mimikatz or reflective PE loading, and renamed module strings defeat file-hash and command-line detection. The durable signal is LSASS process access behavior rather than the mimikatz keyword itself.

What Sysmon events are needed for LSASS dump detection?▼

Sysmon Event ID 10 (ProcessAccess) targeting lsass.exe is the core signal, and Event ID 11 (FileCreate) catches .dmp file writes. Verify EID 10 is enabled and lsass is not excluded in the Sysmon configuration, which is a common gap.

How do attackers dump credentials without Mimikatz?▼

Attackers use LOLBins such as rundll32 comsvcs.dll MiniDump, Task Manager's Create dump file option, or procdump -ma lsass.exe to produce memory dumps with no Mimikatz artifacts. Hunt these command lines plus .dmp file writes.

How do I reduce false positives in LSASS access detection?▼

AV and EDR agents like MsMpEng, backup software, and DLP tools legitimately open lsass handles. Allowlist signed security tools by image path rather than suppressing all LSASS access events.

Does Credential Guard stop Mimikatz detection from working?▼

RunAsPPL and Credential Guard block classic LSASS reads, so attackers may avoid lsass entirely. The Microsoft-Windows-Threat-Intelligence ETW provider catches suspicious lsass handle opens that user-mode logging misses.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Log Analysis & SIEM Integration

Parse security logs and generate SIEM detection queries for Splunk, Elastic, QRadar, Sentinel, and Sigma.

Official
Advanced
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

correlation-insights

Correlate security incidents with events, vulnerabilities, and threat intelligence.

Official
Advanced
mgreen27mgreen27

windows-analysis

Collect and analyze Windows artifacts using Velociraptor for incident response.

Community
Intermediate