Detectionhightest
Potential Invoke-Mimikatz PowerShell Script
Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script
Detection Logic
Detection Logic3 selectors
detection:
selection_1:
ScriptBlockText|contains|all:
- 'DumpCreds'
- 'DumpCerts'
selection_2:
ScriptBlockText|contains: 'sekurlsa::logonpasswords'
selection_3:
ScriptBlockText|contains|all:
- 'crypto::certificates'
- 'CERT_SYSTEM_STORE_LOCAL_MACHINE'
condition: 1 of selection*False Positives
Mimikatz can be useful for testing the security of networks
References
MITRE ATT&CK
Tactics
Techniques
Rule Metadata
Rule ID
189e3b02-82b2-4b90-9662-411eb64486d4
Status
test
Level
high
Type
Detection
Created
Wed Sep 28
Author
Path
rules/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml
Raw Tags
attack.credential-accessattack.t1003