HackTool - Mimikatz Execution

Severity: high
Author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton
Source: upstream

Detection well-known mimikatz command line arguments

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory, `T1003.002` OS Credential Dumping: Security Account Manager, `T1003.004` OS Credential Dumping: LSA Secrets, `T1003.005` OS Credential Dumping: Cached Domain Credentials, `T1003.006` OS Credential Dumping: DCSync

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `1 of selection_tools_name`

or:
CommandLine|contains: DumpCreds
CommandLine|contains: mimikatz

Stage 2: `1 of selection_function_names`

or:
CommandLine|contains: '::aadcookie'
CommandLine|contains: '::detours'
CommandLine|contains: '::memssp'
CommandLine|contains: '::mflt'
CommandLine|contains: '::mstsc'
CommandLine|contains: '::multirdp'
CommandLine|contains: '::ncroutemon'
CommandLine|contains: '::ngcsign'
CommandLine|contains: '::preshutdown'
CommandLine|contains: '::printnightmare'
CommandLine|contains: '::skeleton'

Stage 3: `1 of selection_module_names`

or:
CommandLine|contains: 'crypto::'
CommandLine|contains: 'dpapi::'
CommandLine|contains: 'kerberos::'
CommandLine|contains: 'lsadump::'
CommandLine|contains: 'privilege::'
CommandLine|contains: 'process::'
CommandLine|contains: 'rpc::'
CommandLine|contains: 'sekurlsa::'
CommandLine|contains: 'token::'
CommandLine|contains: 'vault::'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`::aadcookie` `::detours` `::memssp` `::mflt` `::mstsc` `::multirdp` `::ncroutemon` `::ngcsign` `::preshutdown` `::printnightmare` `::skeleton` `DumpCreds` `crypto::` `dpapi::` corpus 2 (sigma 2) `kerberos::` corpus 2 (sigma 2) `lsadump::` corpus 2 (sigma 2) `mimikatz` `privilege::` corpus 2 (sigma 2) `process::` `rpc::` corpus 2 (sigma 2) `sekurlsa::` corpus 2 (sigma 2) `token::` corpus 2 (sigma 2) `vault::`