pypykatz commands (Windows Event Log)

id: '8301.10294'
title: pypykatz commands
description: 'pypykatz is a Mimikatz implementation in Python. This use case looks
  for command parameters associated with pypykatz. -- Threat Actor Association: APT15,
  Muddled Libra, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta)
  -- Software Association: BianLian, Vice Society, Yanluowang -- Atomics T1003.001
  Test #7 Atomics T1003.002 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") (TERM(live) (TERM(lsa) OR TERM(kerberos) OR TERM(smbapi) OR TERM(users)
  OR TERM(token) OR TERM(process) OR TERM(dpapi) OR TERM(smb) OR TERM(ldap) OR TERM(registry)))
  OR (TERM(lsa) (TERM(minidump) OR TERM(rekall))) OR TERM(registry) OR (TERM(crypto)
  (TERM(nt) OR TERM(lm) OR TERM(dcc) OR TERM(dcc2) OR TERM(gppass))) OR (TERM(kerberos)
  (TERM(tgt) OR TERM(tgs) OR TERM(brute) OR TERM(asreproast) OR TERM(spnroast) OR
  TERM(s4u) OR TERM(keytab) OR TERM(ccache) OR TERM(kirbi))) OR (TERM(dpapi) (TERM(prekey)
  OR TERM(minidump) OR TERM(masterkey) OR TERM(credential) OR TERM(vcred) OR TERM(vpol)
  OR TERM(securestring) OR TERM(blob))) OR (TERM(SMB) (TERM(client) OR TERM(lsassfile)
  OR TERM(lsassdump) OR TERM(regfile) OR TERM(regdump) OR TERM(dcsync) OR TERM(secretsdump)
  OR TERM(shareenum) OR TERM(printnightmare) OR TERM(parprintnightmare))) OR (TERM(ldap)
  (client)) | table _time, host, user, signature_id, signature, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host | where match(process,
  "(?i)\s+live\s+(lsa|registry|smb|kerberos|users|token|dpapi|process|ldap)") OR match(process,
  "(?i)\s+((lsa\s+(minidump|rekall|\-\-?\w))|(registry\s+(\-\-?\w|hk|\x5c).+)|(crypto\s+(nt|lm|dcc|gppass|\-\-?\w))|(kerberos\s+(tgt|tgs|brute|asreproast|spnroast|s4u|keytab|ccache|kirbi|\-\-?\w))|(dpapi\s+(prekey|minidump|masterkey|credential|vcred|vpol|securestring|blob|\-\-?\w))|(smb\s+(client|lsassfile|lsassdump|regfile|regdump|dcsync|secretsdump|shareenum|printnightmare|parprintnightmare|\-\-?\w))|(ldap\s+(client|\-\-?\w)))") '
techniques:
- credential-access:os credential dumping
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003
- T1003.001
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html
- https://github.com/skelsec/pypykatz/wiki
- https://github.com/redcanaryco/atomic-red-team/blob/717757d539c1e7d5b8a2ab05b029f4697fbcc978/atomics/T1003.002/T1003.002.md#atomic-test-2---registry-parse-with-pypykatz