Potential Credential Access via Mimikatz

[rule]
description = """
Identifies the usage of Mimikatz using known malicious command line arguments. Mimikatz is a credential dumper capable
of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for
testing the security of networks.
"""
id = "86bf5d50-7f5d-44b4-977b-dff222379727"
license = "Elastic License v2"
name = "Potential Credential Access via Mimikatz"
os_list = ["windows"]
reference = ["https://adsecurity.org/?page_id=1821", "https://github.com/gentilkiwi/mimikatz"]
version = "1.0.28"

query = '''
process where event.action == "start" and
  process.args : (
    "privilege::debug",
    "sekurlsa::logonpasswords",
    "sekurlsa::pth",
    "lsadump::sam",
    "lsadump::dcsync",
    "vault::cred",
    "vault::list",
    "token::elevate",
    "/user:krbtgt",
    "kerberos::tgt",
    "kerberos::ptt",
    "kerberos::list",
    "misc::memssp"
  )
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"

[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"


[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"