mimikatz.sys
Driver on Windows LOLDrivers malicious 1 Sigma rule names it
A known malicious driver
T1068Exploitation for Privilege Escalation
12 known samples
083a311875173f8c4653e9bbbabb689d14aa86b852e7fa9f5512fc60e0fd2c432c14bea0d85c9cad5c5f5c8d0e5442f6deb9e93fe3ad8ea5e8e147821c6f93043033ff03e6f523726638b43d954bc666cdd26483fa5abcf98307952ff88f80ee36f45a42ebf2de6962db92aaf8845d7f9fd6895bedc31422adcf31c59a79602d47356707e610cfd0be97595fbe55246b96a69141e1da579e6f662ddda6dc5280accb1a6604efb1b3ce9345c9fd62fe717a84c3e089e09c638e461df89193ef01b7956e31c2fcc0a84bcedf30e5f8115f4e74eed58916253a0c05c8be47283c57be70be9d84ae14ea1fa5ec68e2a61f6acfe576d965fe51c6bac78fba01a744fbc13f5bc4edfbe8f1884320c5d76ca129d00de41a1e61d45195738f125dfe60a7deade507504d385d8cae11365a2ac9b5e2773ff9b61624d75ffa882d6bb28952e5ddfa39540d4e7ada56cdc1ebd2eb8c85a408ec078337488a81d1c3f2aaa4ffece76b79feafb38ae4371e104b6dcbb4253ff3b2acbe5bd14ce6e47525c24f4aFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names mimikatz.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.