My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. These signatures for mimikatz are included in the ET ATTACK RESPONSE class. This is great but not optimal because the usage has to cross over the "internet" or "datacenter" taps to become visible to an analyst and even then relies on the quality and granularity of the signatures written. So I'm interested in pursuing options or ideas to detect mimikatz at the host level. I have the ability to pull attributes from many many hosts at once with some home grown threading and Python. I just need to know what to look for? Does mimikatz leave any breadcrumbs? Or better yet is there something targetable like a process name or executable path that will be consistent on different platform usage? I'm hunting mimikatz in a Windows environment- the only thing I have found that is interesting is the concept of honey credentials injected into the LSASS- BUT this would need to be a startup script that had admin rights and I do not want admin creds on endpoints. (The injecting creds are fake, but to hit LSASS you must be an admin on the local machine.) there has to be other means of detecting mimikatz in near real time right?
SANS first ran an article on the basics of what you are looking for -- a way to detect mimikatz on the network -- https://isc.sans.edu/diary/Detecting+Mimikatz+Use+On+Your+Network/19311/
However, remember that mimikatz is capable of Kerberos attacks -- https://dfir-blog.com/2015/12/13/protecting-windows-networks-kerberos-attacks/ -- as well as PtH attacks -- https://dfir-blog.com/2015/11/08/protecting-windows-networks-defeating-pass-the-hash/
More on the theory behind the Kereberos attacks is available from Microsoft, including their recommendations for detection -- https://www.blackhat.com/docs/eu-15/materials/eu-15-Beery-Watching-The-Watchdog-Protecting-Kerberos-Authentication-With-Network-Monitoring.pdf
This site also had some interesting log analysis techniques that I had not seen before -- http://securitynik.blogspot.com/2016/03/learning-about-mimikatz-skeletonkey_96.html
Finally, a good defense will also include some mitigation and prevention -- https://jimshaver.net/2016/02/14/defending-against-mimikatz/ -- however, remember that mimikatz has been rewritten in GoLang and Powershell, so your mileage may vary when trying to prevent a well-informed attacker.