← Sashreeka Ranaweera
ALT-001 High Malicious True Positive

Mimikatz credential theft tool

16 Aug 2026 ec2amaz-9oh9aqq / NT AUTHORITY\SYSTEM
Completed in a
live SOCSIM lab
Alert Summary
Host / Account ec2amaz-9oh9aqq / NT AUTHORITY\SYSTEM
Date & Time 6 Aug 2026 09:47:19
Alert ID da4ffcc43b-b684-4ba5-a5a8-19bfb9218fe6_1
What triggered it: Microsoft Defender for Endpoint detected a Mimikatz credential theft tool execution attempt. The alert was triggered when PowerShell attempted to download and execute Mimikatz (mimikatz.exe). The command included credential dumping functions, 1) privilege::debug 2) sekurlsa::logonpasswords
Why it triggered:

mimikatz 1

  • The activity matched known credential access behaviour associated with Mimikatz.
  • The process chain showed suspicious execution,
    wusvc.exe (Sandcat/CALDERA agent)
    PowerShell
    Mimikatz execution attempt
  • The behaviour was suspicious because Mimikatz is commonly used to attempt credential extraction from Windows systems.
What Happened

mimikatz 2

  • A suspicious wusvc.exe process associated with a Sandcat/CALDERA agent was running on the endpoint.

  • The process executed PowerShell commands that downloaded and attempted to execute Mimikatz, a credential access tool.

  • The Mimikatz command included,

  • privilege::debug - Attempts to enable the Windows debug privilege, which allows Mimikatz to access protected processes such as LSASS.
  • sekurlsa::logonpasswords - Attempts to extract credential information from Windows authentication processes.
  • Microsoft Defender detected and blocked the Mimikatz execution attempt.
  • Additional command activity showed the system searching for Firefox profile locations and logins.json files, indicating an attempt to locate stored browser credential data.
Evidence
  • Process tree:
  • nssm.exe,
    • wusvc.exe
    • PowerShell
    • Mimikatz execution attempt
    • cmd.exe Firefox credential file discovery
  • Suspicious executable:
  • File: C:\Users\Public\wusvc.exe
  • Signer: Unknown
  • Detection: Trojan:Win64/SandCat.RTS!MTB
  • PowerShell command activity:
  • PowerShell was used to download, extract, and attempt to execute Mimikatz.
  • Actions observed,
    • Downloaded the Mimikatz archive.
    • Extracted the archive using Expand-Archive.
    • Attempted to execute mimikatz.exe.
  • Mimikatz commands observed:
  • privilege::debug
    • Attempts to enable the Windows debug privilege, allowing access to protected processes such as LSASS.
  • sekurlsa::logonpasswords
    • Attempts to retrieve credential information from Windows authentication processes.
  • Credential discovery activity:
  • Commands searched for:
    • Firefox profile directories.
    • logins.json files.
  • Network communication:
  • wusvc.exe communicated with:
    • 172.31.2.203:8888
  • The communication was associated with the Sandcat/CALDERA agent command-and-control (C2) channel.
Was the activity successful? No
Verdict
Malicious True Positive
  • The alert was classified as Malicious because the activity showed credential access behaviour associated with Mimikatz.
  • The investigation identified a suspicious process chain:- wusvc.exe (Sandcat/CALDERA agent)
  • PowerShell
  • Mimikatz execution attempt
  • The PowerShell command downloaded and attempted to execute Mimikatz with,
  • privilege::debug
  • sekurlsa::logonpasswords
  • Additional commands searched for Firefox credential files (logins.json), indicating an attempt to locate stored credentials.
  • The alert was classified as a True Positive (TP) because Microsoft Defender correctly detected malicious activity. Although Defender blocked the Mimikatz execution, the behaviour itself was malicious.
Investigation Steps
  1. 1 Step 1: Reviewed the Microsoft Defender alert details and identified the detection as a Mimikatz credential theft tool execution attempt.
  2. 2 Step 2: Analysed the process tree to identify the execution chain: nssm.exe → wusvc.exe → PowerShell → Mimikatz execution attempt.
  3. 3 Step 3: Reviewed command-line activity to understand the PowerShell actions, including downloading, extracting, and attempting to execute Mimikatz.
  4. 4 Step 4: Analysed the Mimikatz commands (privilege::debug and sekurlsa::logonpasswords) to determine the credential access behaviour.
  5. 5 Step 5: Reviewed additional command activity for credential discovery attempts, including searches for Firefox profiles and logins.json files.
  6. 6 Step 6: Reviewed network activity and identified communication between wusvc.exe and the Sandcat/CALDERA C2 server (172.31.2.203:8888).
  7. 7 Step 7: Determined the alert classification as Malicious - True Positive and confirmed that Defender blocked the Mimikatz execution attempt.
Queries Used
No KQL queries used. Investigation performed using Microsoft Defender for Endpoint.
Recommended Actions
Escalation Urgent
Alert Tuning No tuning required

mimikatz 3

  1. Confirmed Microsoft Defender successfully blocked the Mimikatz execution attempt.
  2. Isolate the affected endpoint if further suspicious activity is observed.
  3. Remove the malicious files/processes associated with the Sandcat agent (wusvc.exe).
  4. Investigate related alerts and activity on the affected device.
  5. Review and reset affected credentials if credential compromise is suspected.
  6. Continue monitoring for similar credential access attempts.
Lessons Learned
  1. Mimikatz-related activity should be treated as high priority due to its ability to access sensitive credentials.
  2. Analysing process trees and command-line activity helps identify the full execution chain and attacker behaviour.
  3. Security tools such as Microsoft Defender can prevent credential theft attempts when detections are triggered.
  4. Monitoring suspicious PowerShell activity and credential discovery commands can help detect similar attacks.
Tools Used
Microsoft Defender for Endpoint