Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectioncriticaltest

HackTool - Mimikatz Kirbi File Creation

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems), David ANDRECreated Mon Nov 08Updated Thu Jun 279e099d99-44c2-42b6-a6d8-54c3545cab29windows
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        TargetFilename|endswith:
            - '.kirbi' # Kerberos tickets
            - 'mimilsa.log' # MemSSP default file
    condition: selection
False Positives
Unlikely

False positives are unlikely for most environments. High confidence detection.

References
1
Resolving title…
cobalt.io
2
Resolving title…
pentestlab.blog
MITRE ATT&CK
Related Rules
Similar

034affe8-6170-11ec-844f-0f78aa0c4d66

Rule not found
Rule Metadata
Rule ID
9e099d99-44c2-42b6-a6d8-54c3545cab29
Status
test
Level
critical
Type
Detection
Created
Mon Nov 08
Modified
Thu Jun 27
Author
Florian Roth (Nextron Systems), David ANDRE
Path
rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml
Raw Tags
attack.credential-accessattack.t1558
View on GitHub