Mimikatz command-line arguments

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	OS Credential Dumping (T1003)
Severity	High

Description

These command-line arguments are often used by Mimikatz to dump and harvest credentials.

Attacker's Goals

An attacker is attempting to use Mimikatz, a known credential theft tool, to dump and harvest credentials.

Investigative actions

• Investigate the executed process to verify if it is malicious.
• Investigate the command line purpose.