Mimikatz malicious Security package (SSP) exfiltrates cleartext passwords in file

Status: experimental
Severity: high
Log source: category file_event, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker loaded the Mimikatz SSP "mimilib.dll" into the LSA process in order to exfiltrate clear text passwords into a file.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003` OS Credential Dumping

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Mimikatz malicious Security package (SSP) exfiltrates cleartext passwords in file
description: Detects scenarios where an attacker loaded the Mimikatz SSP "mimilib.dll" into the LSA process in order to exfiltrate clear text passwords into a file.
requirements: SYSMON configuration provided at the following is required - https://github.com/Neo23x0/sysmon-config/pull/22
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#custom-ssp
tags:
- attack.credential_access
- attack.t1003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: file_event
detection:
  selection:
    EventID: 11 # File creation
    Image|endswith: \Windows\system32\lsass.exe
    TargetFilename|endswith:
      - \Windows\System32\mimilsa.log # recent versions
      - \Windows\System32\kiwissp.log # old versions
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 11
  Image|endswith: \Windows\system32\lsass.exe
  TargetFilename|endswith:
    - \Windows\System32\mimilsa.log
    - \Windows\System32\kiwissp.log

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\Windows\system32\lsass.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\Windows\system32\lsass.exe"`
`TargetFilename`	ends_with	`\Windows\System32\kiwissp.log` `\Windows\System32\mimilsa.log`	`field:"TargetFilename" kind:ends_with`