Detection rules › Splunk
Mimikatz (Windows Event Log)
Mimikatz is used to extract plaintexts passwords, hash, PIN code and Kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets
MITRE ATT&CK coverage
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4656 | A handle to an object was requested. |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 4690 | An attempt was made to duplicate a handle to an object. |
Rule body yaml
id: '1033.1042'
title: Mimikatz
description: 'Mimikatz is used to extract plaintexts passwords, hash, PIN code and
Kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket
or build Golden tickets. -- Threat Actor Association: APT10/Cicada, APT27/Emissary
Panda, APT29/Nobelium, APT41/Wicked Panda, Carbanak, DarkSide, BlackMatter, FamousSparrow,
FIN7, FIN12, Hello Kitty / Five Hands, Karakurt, Lapsus$, LockBit, Memento Team,
TRACER KITTEN, TRAVELING SPIDER, SILENCE, UNC2596, Witchetty -- Software Association:
Blackcat/ALPHV, Conti, Cuba, Midas, Lockbit, LV, Nefilim, Play, Qakbot, Revil, SamSam,
Stonefly, WASTEDLOCKER -- Atomics T1003.001 Test #6 Atomics T1003.001 Test #10 Atomics
T1550.002 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) ("cmd.exe" OR "powershell.exe") OR ((TERM(EventCode=4690)
OR "<EventID>4690<") Target_Process_ID="0x4") OR ((TERM(EventCode=4656) OR "<EventID>4656<")
"lsass.exe" TERM(Read) TERM(from) TERM(process) TERM(memory)) | eval Source_Process_ID=if(like(Source_Process_ID,"%x%"),tonumber(Source_Process_ID,16),Source_Process_ID)|
eval process_id=mvappend(process_id, Source_Process_ID) | table _time, host, user
signature_id, user, process_id, process_name, process_path, process, parent_process_id,
parent_process_name, parent_process_path | bin span=5s | stats values(*) as * by
_time, host, user | eventstats dc(signature_id) as dc_signature_id by process_id,
_time| where dc_signature_id=3 '
techniques:
- credential-access:os credential dumping:lsass memory
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping:dcsync
- credential-access:os credential dumping:lsa secrets
- credential-access:steal or forge kerberos tickets:golden ticket
- credential-access:steal or forge kerberos tickets:silver ticket
- credential-access:unsecured credentials:credentials in registry
technique_id:
- T1552.002
- T1003.006
- T1003.004
- T1003.002
- T1558.002
- T1558.001
- T1003.001
data_category:
- Windows event logs
references:
- https://www.sans.org/reading-room/whitepapers/detection/mimikatz-overview-defenses-detection-36780
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("cmd.exe" OR "powershell.exe") OR ((TERM(EventCode=4690) OR "<EventID>4690<") Target_Process_ID="0x4") OR ((TERM(EventCode=4656) OR "<EventID>4656<") "lsass.exe" TERM(Read) TERM(from) TERM(process) TERM(memory))
Stage 2: eval
| eval Source_Process_ID=if(like(Source_Process_ID,"%x%"),tonumber(Source_Process_ID,16),Source_Process_ID)
Stage 3: eval
| eval process_id=mvappend(process_id, Source_Process_ID)
Stage 4: table
| table _time, host, user signature_id, user, process_id, process_name, process_path, process, parent_process_id, parent_process_name, parent_process_path
Stage 5: bucket
| bin span=5s
Stage 6: stats
| stats values(*) as * by _time, host, user
Stage 7: eventstats
| eventstats dc(signature_id) as dc_signature_id by process_id, _time
Stage 8: where
| where dc_signature_id=3
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Target_Process_ID | eq |
|
dc_signature_id | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "cmd.exe" |
| 1 | "powershell.exe" |
| 1 | TERM |
| 1 | "<EventID>4690<" |
| 1 | TERM |
| 1 | "<EventID>4656<" |
| 1 | "lsass.exe" |
| 1 | TERM |
| 1 | Read |
| 1 | TERM |
| 1 | from |
| 1 | TERM |
| 1 | process |
| 1 | TERM |
| 1 | memory |