Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Mimikatz Use

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems), David ANDRE (additional keywords)Created Tue Jan 10Updated Wed Jan 0506d71506-7beb-4f22-8888-e2e5e2ca7fd8windows
Log Source
Windows
ProductWindows← raw: windows
Detection Logic
Detection Logic2 selectors
detection:
    keywords:
        - 'dpapi::masterkey'
        - 'eo.oe.kiwi'
        - 'event::clear'
        - 'event::drop'
        - 'gentilkiwi.com'
        - 'kerberos::golden'
        - 'kerberos::ptc'
        - 'kerberos::ptt'
        - 'kerberos::tgt'
        - 'Kiwi Legit Printer'
        - 'lsadump::'
        - 'mimidrv.sys'
        - '\mimilib.dll'
        - 'misc::printnightmare'
        - 'misc::shadowcopies'
        - 'misc::skeleton'
        - 'privilege::backup'
        - 'privilege::debug'
        - 'privilege::driver'
        - 'sekurlsa::'
    filter:
        EventID: 15  # Sysmon's FileStream Events (could cause false positives when Sigma rules get copied on/to a system)
    condition: keywords and not filter
False Positives

Naughty administrators

AV Signature updates

Files with Mimikatz in their filename

References
1
Resolving title…
tools.thehacker.recipes
MITRE ATT&CK

CAR Analytics

2013-07-001 · CAR 2013-07-0012019-04-004 · CAR 2019-04-004
Rule Metadata
Rule ID
06d71506-7beb-4f22-8888-e2e5e2ca7fd8
Status
test
Level
high
Type
Detection
Created
Tue Jan 10
Modified
Wed Jan 05
Author
Florian Roth (Nextron Systems), David ANDRE (additional keywords)
Path
rules/windows/builtin/win_alert_mimikatz_keywords.yml
Raw Tags
attack.s0002attack.lateral-movementattack.credential-accesscar.2013-07-001car.2019-04-004attack.t1003.002attack.t1003.004attack.t1003.001attack.t1003.006
View on GitHub