Detection rules › Sigma
Mimikatz driver registration (Reg via Sysmon)
Detects scenarios where an attacker installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.
Known false positives
- None
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation |
Telemetry coverage
Rule body
title: Mimikatz driver registration (Reg via Sysmon)
description: Detects scenarios where an attacker installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1543.003-Create%20or%20Modify%20System%20Process-Windows%20Service
- https://posts.specterops.io/mimidrv-in-depth-4d273d19e148?gi=a5033fbeb71d
- https://gorkemkaradeniz.medium.com/defeating-runasppl-utilizing-vulnerable-drivers-to-read-lsass-with-mimikatz-28f4b50b1de5
tags:
- attack.privilege_escalation
- attack.t1543.003
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: registry_event
detection:
selection:
TargetObject|startswith: 'HKLM\System\CurrentControlSet\Services\mimidrv'
condition: selection
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
TargetObject|startswith: 'HKLM\System\CurrentControlSet\Services\mimidrv'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetObject | starts_with |
| field:"TargetObject" kind:starts_with value:"HKLM\System\CurrentControlSet\Services\mimidrv" |