HackTool - Mimikatz Execution

Title: HackTool - Mimikatz Execution
Status: test
Description:Detection well-known mimikatz command line arguments
References:
  -https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  -https://tools.thehacker.recipes/mimikatz/modules
Author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton
Date: 2019-10-22
modified:2023-02-21
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'
• -'attack.t1003.002'
• -'attack.t1003.004'
• -'attack.t1003.005'
• -'attack.t1003.006'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_tools_name:
    CommandLine|contains:
      -'DumpCreds'
      -'mimikatz'

  selection_function_names:
    CommandLine|contains:
      -'::aadcookie'
      -'::detours'
      -'::memssp'
      -'::mflt'
      -'::ncroutemon'
      -'::ngcsign'
      -'::printnightmare'
      -'::skeleton'
      -'::preshutdown'
      -'::mstsc'
      -'::multirdp'

  selection_module_names:
    CommandLine|contains:
      -'rpc::'
      -'token::'
      -'crypto::'
      -'dpapi::'
      -'sekurlsa::'
      -'kerberos::'
      -'lsadump::'
      -'privilege::'
      -'process::'
      -'vault::'

  condition:1 of selection_*
Falsepositives:
  -Unlikely
Level: high