ThreatFox: MimiKatz IOCs

Hunt Hypothesis

This hunt targets the presence of known MimiKatz indicators, which adversaries deploy to extract plaintext credentials from Windows memory for lateral movement and privilege escalation. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing attackers from leveraging stolen credentials to expand their foothold across the environment.

IOC Summary

Malware Family: MimiKatz Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - MimiKatz
let malicious_hashes = dynamic(["fec27228340485485f6902f8759bbd62", "f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072", "07b35a3b431e653ddcf36cecd49793d538e2aa79"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — MimiKatz

False Positive Guidance

• Legitimate Credential Dumping by Privileged Admins: A senior system administrator or a service account with SeDebugPrivilege uses a standard tool like procdump or comsvcs to capture a memory dump of a hung service for troubleshooting, which may contain the same hash patterns or strings associated with MimiKatz if the tool is renamed or if the IOCs are based on generic memory signatures.

  • Filter/Exclusion: Exclude processes where the parent process is a known administrative utility (e.g., procdump.exe, windbg.exe) or where the user belongs to the Domain Admins or Enterprise Admins group and the action is initiated from a management console.

• Antivirus/EDR Self-Scan or Signature Update: During a full system scan or a signature database update, the EDR agent may load MimiKatz-related YARA rules or hash lists into memory to compare against running processes, potentially triggering IOC matches if the detection logic looks for specific strings or hashes in process memory rather than on disk.

  • Filter/Exclusion: Exclude events where the process name matches known EDR/AV agents (e.g., MsMpEng.exe, CrowdStrike Falcon Sensor, Carbon Black) or where the command line contains arguments related to scanning, updating, or self-diagnosis.

• Scheduled Maintenance Jobs Using Custom Scripts: An IT operations team runs a scheduled PowerShell or Batch job that uses a custom internal script to audit service account credentials or verify password complexity by reading the SAM registry or LSASS memory via a wrapper script that may inadvertently match one of the three IOCs (e.g., if the script name or path contains “mimikatz” for documentation purposes).

  • Filter/Exclusion: Exclude processes where the parent process is Task Scheduler (taskschd.msc or