Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

Detects a highly relevant Antivirus alert that reports a password dumper

Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.