HackTool - Mimikatz Execution

Hunt Hypothesis

Detection well-known mimikatz command line arguments

Detection Rule

Sigma (Original)

title: HackTool - Mimikatz Execution
id: a642964e-bead-4bed-8910-1bb4d63e3b4d
status: test
description: Detection well-known mimikatz command line arguments
references:
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
    - https://tools.thehacker.recipes/mimikatz/modules
author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton
date: 2019-10-22
modified: 2023-02-21
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1003.002
    - attack.t1003.004
    - attack.t1003.005
    - attack.t1003.006
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools_name:
        CommandLine|contains:
            - 'DumpCreds'
            - 'mimikatz'
    selection_function_names: # To cover functions from modules that are not in module_names
        CommandLine|contains:
            - '::aadcookie' # misc module
            - '::detours' # misc module
            - '::memssp' # misc module
            - '::mflt' # misc module
            - '::ncroutemon' # misc module
            - '::ngcsign' # misc module
            - '::printnightmare' # misc module
            - '::skeleton' # misc module
            - '::preshutdown'  # service module
            - '::mstsc'  # ts module
            - '::multirdp'  # ts module
    selection_module_names:
        CommandLine|contains:
            - 'rpc::'
            - 'token::'
            - 'crypto::'
            - 'dpapi::'
            - 'sekurlsa::'
            - 'kerberos::'
            - 'lsadump::'
            - 'privilege::'
            - 'process::'
            - 'vault::'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

KQL (Azure Sentinel)

imProcessCreate
| where (TargetProcessCommandLine contains "DumpCreds" or TargetProcessCommandLine contains "mimikatz") or (TargetProcessCommandLine contains "::aadcookie" or TargetProcessCommandLine contains "::detours" or TargetProcessCommandLine contains "::memssp" or TargetProcessCommandLine contains "::mflt" or TargetProcessCommandLine contains "::ncroutemon" or TargetProcessCommandLine contains "::ngcsign" or TargetProcessCommandLine contains "::printnightmare" or TargetProcessCommandLine contains "::skeleton" or TargetProcessCommandLine contains "::preshutdown" or TargetProcessCommandLine contains "::mstsc" or TargetProcessCommandLine contains "::multirdp") or (TargetProcessCommandLine contains "rpc::" or TargetProcessCommandLine contains "token::" or TargetProcessCommandLine contains "crypto::" or TargetProcessCommandLine contains "dpapi::" or TargetProcessCommandLine contains "sekurlsa::" or TargetProcessCommandLine contains "kerberos::" or TargetProcessCommandLine contains "lsadump::" or TargetProcessCommandLine contains "privilege::" or TargetProcessCommandLine contains "process::" or TargetProcessCommandLine contains "vault::")

Required Data Sources

False Positive Guidance

• Unlikely

MITRE ATT&CK Context

• Tactic: Credential Access
• Technique: T1003.001 — T1003.001
• Technique: T1003.002 — T1003.002
• Technique: T1003.004 — T1003.004
• Technique: T1003.005 — T1003.005
• Technique: T1003.006 — T1003.006

References

• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
• https://tools.thehacker.recipes/mimikatz/modules
• SigmaHQ Rule