Why key on the module syntax rather than only the file name?

Because renaming mimikatz.exe takes a second and attackers routinely do it, while the module::command syntax is how Mimikatz is driven whatever the binary is called. `sekurlsa::logonpasswords` reads credentials from LSASS memory, `lsadump::` covers the SAM database, LSA secrets and DCSync, `kerberos::golden` forges Kerberos tickets, and `privilege::debug` is the step that comes first. The file-name branch is a cheap extra for the unrenamed case.

Why is this critical when the encoded-PowerShell rule is medium?

Because the false-positive picture is different. Plenty of legitimate software runs PowerShell with an encoded command, so that signal needs triage. A command line that calls Mimikatz credential modules has essentially no legitimate use outside authorized security testing, and it means credentials on that host are being harvested now.

What should I do when it fires?

Isolate the host, then assume every credential that has touched it is compromised: accounts with sessions on the machine, cached domain credentials and service accounts. Reset them, starting with privileged ones, and look for the same account or source logging in elsewhere. A `lsadump::dcsync` or `kerberos::golden` command means the domain itself is at risk: involve your Active Directory owners immediately.

What happened to the encoded-PowerShell and watchlist branches this rule used to have?

They were removed because they need different severities and responses. Encoded PowerShell is a medium-severity signal with real false positives (see the CrowdStrike rule LTR-0026 for that detection), and an alert on any Carbon Black watchlist hit inherits whatever quality your watchlists have. Keeping one coherent behavior per rule keeps the severity honest.

Detect Mimikatz Credential Dumping in Carbon Black EDR Process Events

Published October 19, 2026 · Updated October 20, 2026

Sigma Rule

title: Mimikatz Credential Dumping in Carbon Black EDR
id: 9e2f6b1a-4c7d-4a8e-9b3f-1d6a7c2e5f08
status: experimental
description: >
  Detects Mimikatz in Carbon Black EDR process events: a command line using
  one of its credential modules (sekurlsa:: for LSASS memory, lsadump:: for
  SAM, LSA secrets and DCSync, kerberos::golden for forged tickets, and
  privilege::debug, which it runs first), or a process image named
  mimikatz.exe.
references:
  - https://attack.mitre.org/techniques/T1003/001/
  - https://attack.mitre.org/techniques/T1003/006/
  - https://attack.mitre.org/techniques/T1558/001/
author: LogTriage
date: 2026/10/19
modified: 2026/10/20
logsource:
  product: carbonblack
  category: process_creation
detection:
  mimikatz_module:
    cmdline|contains:
      - 'sekurlsa::'
      - 'lsadump::'
      - 'kerberos::golden'
      - 'privilege::debug'
  mimikatz_binary:
    path|endswith: '\mimikatz.exe'
  condition: mimikatz_module or mimikatz_binary
falsepositives:
  - Authorized red-team or penetration test (correlate with the engagement)
  - Security tools or test files named mimikatz.exe on analyst machines
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001
  - attack.t1003.006
  - attack.t1558.001

What this rule detects

Mimikatz is the standard tool for harvesting credentials from Windows: passwords and hashes from LSASS memory, the SAM database and LSA secrets, domain hashes via DCSync, and forged Kerberos tickets. Carbon Black EDR records the command line and image path of every process, which is where Mimikatz shows itself.

This rule fires on a process event whose command line calls one of Mimikatz’s credential modules, or whose image is mimikatz.exe.

Detection logic

Two selections, either of which fires the rule:

mimikatz_module: cmdline contains sekurlsa::, lsadump::, kerberos::golden or privilege::debug, the module syntax Mimikatz uses whatever its file is called.
mimikatz_binary: path ends with \mimikatz.exe, for the case where the attacker did not bother to rename it.

The condition is mimikatz_module or mimikatz_binary.

Validated against a real sample

Validated against carbonblack_attack.json (shipped with LogTriage). The rule fires on one of its four events: a watchlist.hit.process event on DESKTOP-VICTIM for CORP\jsmith, running C:\Temp\mimikatz.exe with the command line mimikatz.exe privilege::debug sekurlsa::logonpasswords, which reads every credential in LSASS memory.

The other events are context: an encoded PowerShell process (cmd.exe /c powershell -enc ...) and a connection to 185.220.101.42:4444 from the same host, and a Carbon Black alert on SERVER-01 for traffic to malware-c2.ru. It stays silent on carbonblack_normal.json, which contains a Chrome process start, a connection to Google and a document save.

False positives

Authorized security testing is the recurring case: correlate with the engagement’s dates and host list. A security team’s own tooling can also carry the file name; allowlist it by full path after confirming it, never by name alone. Everything else should be treated as active credential theft.

Frequently Asked Questions

Why key on the module syntax rather than only the file name?: Because renaming mimikatz.exe takes a second and attackers routinely do it, while the module::command syntax is how Mimikatz is driven whatever the binary is called. `sekurlsa::logonpasswords` reads credentials from LSASS memory, `lsadump::` covers the SAM database, LSA secrets and DCSync, `kerberos::golden` forges Kerberos tickets, and `privilege::debug` is the step that comes first. The file-name branch is a cheap extra for the unrenamed case.
Why is this critical when the encoded-PowerShell rule is medium?: Because the false-positive picture is different. Plenty of legitimate software runs PowerShell with an encoded command, so that signal needs triage. A command line that calls Mimikatz credential modules has essentially no legitimate use outside authorized security testing, and it means credentials on that host are being harvested now.
What should I do when it fires?: Isolate the host, then assume every credential that has touched it is compromised: accounts with sessions on the machine, cached domain credentials and service accounts. Reset them, starting with privileged ones, and look for the same account or source logging in elsewhere. A `lsadump::dcsync` or `kerberos::golden` command means the domain itself is at risk: involve your Active Directory owners immediately.
What happened to the encoded-PowerShell and watchlist branches this rule used to have?: They were removed because they need different severities and responses. Encoded PowerShell is a medium-severity signal with real false positives (see the CrowdStrike rule LTR-0026 for that detection), and an alert on any Carbon Black watchlist hit inherits whatever quality your watchlists have. Keeping one coherent behavior per rule keeps the severity honest.

See this detection run on a real report

Try the live demo with a pre-loaded malicious log set — no signup required — or upload your own log file and get a full AI-reviewed threat report in minutes.

Try Live Demo → Analyze Your Own Logs