Sysmon Event 1 mimikatz command line

Sysmon config: <CommandLine condition='contains'>sekurlsa</CommandLine> + <CommandLine condition='contains'>logonpasswords</CommandLine>

Sysmon rule (Event 1) that alerts on the characteristic mimikatz arguments in the command line of any process.

Deploy this rule as your first line of detection for mimikatz: the arguments sekurlsa::logonpasswords, sekurlsa::msv, lsadump::dcsync (or variants with quotes and weird spacing) are the unmistakable signature of credential dumping. Sysmon Event 1 captures the full command line of each new process if CommandLine auditing is enabled, and the rule matches on the characteristic tokens. It's the cheapest detection you can get against un-obfuscated mimikatz — the one that catches 90% of ransomware actors who download the binary and just run it.

Don't rely on it as your only detection: obfuscated mimikatz (arguments with split quotes, Unicode characters, or loaded in memory with a loader that doesn't expose the command line) evades it effortlessly. Advanced actors invoke mimikatz functions from legitimate processes or via reflective loading, where Event 1 sees nothing. And watch out for false positives: support tools that mention sekurlsa in help logs, or hardening scripts that search for the string, will trigger the rule. Use it as a fast detection layer, not the only one.