Detection rules › Sigma

Mimikatz driver deployed via service

Status
experimental
Severity
high
Log source
product windows, service ['system', 'security']
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: Mimikatz driver deployed via service
description: Detects scenarios where an attacker installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1543.003-Create%20or%20Modify%20System%20Process-Windows%20Service
- https://posts.specterops.io/mimidrv-in-depth-4d273d19e148?gi=a5033fbeb71d
- https://gorkemkaradeniz.medium.com/defeating-runasppl-utilizing-vulnerable-drivers-to-read-lsass-with-mimikatz-28f4b50b1de5
tags:
- attack.privilege_escalation
- attack.t1543.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: 
    - system
    - security
detection:
  selection:
    EventID:
      - 4697 # SECURITY logs: new service
      - 7045 # SYSTEM logs: new service
    ServiceName|contains:
      - mimidrv
      - mimikatz
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID:
    - 4697
    - 7045
  ServiceName|contains:
    - mimidrv
    - mimikatz

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ServiceNamematch
  • mimidrv corpus 2 (sigma 1, kusto 1)
  • mimikatz corpus 2 (sigma 1, kusto 1)