Detection rules › Splunk
Mimikatz Execution (Windows Event Log)
Mimikatz is used to extract plaintexts passwords, hash, PIN code and Kerberos tickets from memory. This use case looks for keywords leveraged while using Mimikatz
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
id: '13473.19309'
title: Mimikatz Execution
description: 'Mimikatz is used to extract plaintexts passwords, hash, PIN code and
Kerberos tickets from memory. This use case looks for keywords leveraged while using
Mimikatz -- Threat Actor Association: Alloy Taurus/Gallium, APT10/Cicada, APT15,
APT27/Emissary Panda, APT29/Nobelium, APT41/Wicked Panda, Carbanak, CL-STA-0043,
DarkSide, BlackMatter, FamousSparrow, FIN7, FIN12, Flax Typhoon, Hello Kitty / Five
Hands, Karakurt, Lapsus$, Lazarus, LockBit, Memento Team, Muddled Libra, Mustang
Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), OilRig,
TRACER KITTEN, TRAVELING SPIDER, Scattered Spider (aka. 0ktapus, UNC3944), SILENCE,
UNC2596 -- Software Association: AvosLocker, Blackcat/ALPHV, BlackByte, Conti, Cuba,
Midas, Lockbit, LV, Nefilim, Play, Qakbot, Ransom Cartel, Revil, SamSam, Stonefly,
Trigona, Vice Society, WASTEDLOCKER -- Atomics T1003.001 Test #6 Atomics T1003.001
Test #10 Atomics T1550.002 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) ("mimikatz.exe") OR TERM(sekurlsa::logonpasswords)
OR TERM(sekurlsa::pth) OR TERM(sekurlsa::tickets) OR TERM(lsadump::lsa) | table
_time, host, user process, process_*, signature_id, parent_* src_* dest_* | bin
span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:unsecured credentials
- credential-access:os credential dumping
technique_id:
- T1552
- T1003
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.sans.org/reading-room/whitepapers/detection/mimikatz-overview-defenses-detection-36780
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("mimikatz.exe") OR TERM(sekurlsa::logonpasswords) OR TERM(sekurlsa::pth) OR TERM(sekurlsa::tickets) OR TERM(lsadump::lsa)
Stage 2: table
| table _time, host, user process, process_*, signature_id, parent_* src_* dest_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4688" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4688<" |
| 1 | "mimikatz.exe" |
| 1 | "sekurlsa::logonpasswords" |
| 1 | "sekurlsa::pth" |
| 1 | "sekurlsa::tickets" |
| 1 | "lsadump::lsa" |