Detection rules › Splunk
Mimikatz (Windows Event Log)
Mimikatz is used to extract plaintexts passwords, hash, PIN code and Kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets
MITRE ATT&CK coverage
References
Telemetry coverage
Rule body
id: '1033.1042'
title: Mimikatz
description: 'Mimikatz is used to extract plaintexts passwords, hash, PIN code and
Kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket
or build Golden tickets. -- Threat Actor Association: APT10/Cicada, APT27/Emissary
Panda, APT29/Nobelium, APT41/Wicked Panda, Carbanak, DarkSide, BlackMatter, FamousSparrow,
FIN7, FIN12, Hello Kitty / Five Hands, Karakurt, Lapsus$, LockBit, Memento Team,
TRACER KITTEN, TRAVELING SPIDER, SILENCE, UNC2596, Witchetty -- Software Association:
Blackcat/ALPHV, Conti, Cuba, Midas, Lockbit, LV, Nefilim, Play, Qakbot, Revil, SamSam,
Stonefly, WASTEDLOCKER -- Atomics T1003.001 Test #6 Atomics T1003.001 Test #10 Atomics
T1550.002 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) ("cmd.exe" OR "powershell.exe") OR ((TERM(EventCode=4690)
OR "<EventID>4690<") Target_Process_ID="0x4") OR ((TERM(EventCode=4656) OR "<EventID>4656<")
"lsass.exe" TERM(Read) TERM(from) TERM(process) TERM(memory)) | eval Source_Process_ID=if(like(Source_Process_ID,"%x%"),tonumber(Source_Process_ID,16),Source_Process_ID)|
eval process_id=mvappend(process_id, Source_Process_ID) | table _time, host, user
signature_id, user, process_id, process_name, process_path, process, parent_process_id,
parent_process_name, parent_process_path | bin span=5s | stats values(*) as * by
_time, host, user | eventstats dc(signature_id) as dc_signature_id by process_id,
_time| where dc_signature_id=3 '
techniques:
- credential-access:os credential dumping:lsass memory
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping:dcsync
- credential-access:os credential dumping:lsa secrets
- credential-access:steal or forge kerberos tickets:golden ticket
- credential-access:steal or forge kerberos tickets:silver ticket
- credential-access:unsecured credentials:credentials in registry
technique_id:
- T1552.002
- T1003.006
- T1003.004
- T1003.002
- T1558.002
- T1558.001
- T1003.001
data_category:
- Windows event logs
references:
- https://www.sans.org/reading-room/whitepapers/detection/mimikatz-overview-defenses-detection-36780
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("cmd.exe" OR "powershell.exe") OR ((TERM(EventCode=4690) OR "<EventID>4690<") Target_Process_ID="0x4") OR ((TERM(EventCode=4656) OR "<EventID>4656<") "lsass.exe" TERM(Read) TERM(from) TERM(process) TERM(memory))
Stage 2: eval
| eval Source_Process_ID=if(like(Source_Process_ID,"%x%"),tonumber(Source_Process_ID,16),Source_Process_ID)
Stage 3: eval
| eval process_id=mvappend(process_id, Source_Process_ID)
Stage 4: table
| table _time, host, user signature_id, user, process_id, process_name, process_path, process, parent_process_id, parent_process_name, parent_process_path
Stage 5: bucket
| bin span=5s
Stage 6: stats
| stats values(*) as * by _time, host, user
Stage 7: eventstats
| eventstats dc(signature_id) as dc_signature_id by process_id, _time
Stage 8: where
| where dc_signature_id=3
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq |
Target_Process_ID | eq |
| field:"Target_Process_ID" kind:eq |
dc_signature_id | eq |
| field:"dc_signature_id" kind:eq value:"3" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4688<" |
| 1 | "cmd.exe" |
| 1 | "powershell.exe" |
| 1 | "<EventID>4690<" |
| 1 | "<EventID>4656<" |
| 1 | "lsass.exe" |
| 1 | Read |
| 1 | from |
| 1 | process |
| 1 | memory |