This analytic rule is designed to detect the execution of Mimikatz commands using PowerShell Script Block Logging. By monitoring EventCode 4104, it captures the complete script block sent to PowerShell, enabling the identification of specific suspicious commands such as 'mimikatz', 'sekurlsa::pth', and others associated with credential dumping and lateral movement techniques often used by attackers. The detection focuses on the capabilities of Mimikatz, a notorious tool used for obtaining credentials and enabling unauthorized access to sensitive information. The implementation of this rule requires PowerShell Script Block Logging to be enabled on the relevant endpoints, allowing for effective monitoring and response to potential threats posed by the misuse of PowerShell in the environment.