(EventID:5805 OR EventID:5723) ("kali" OR "mimikatz")