CmdID / Rules / Windows

HackTool - Mimikatz Execution

A Sigma rule for process creation on Windows, by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton.

high 5 ATT&CK techniques 41 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection_function_names:
    CommandLine|contains:
      - '::aadcookie'
      - '::detours'
      - '::memssp'
      - '::mflt'
      - '::ncroutemon'
      - '::ngcsign'
      - '::printnightmare'
      - '::skeleton'
      - '::preshutdown'
      - '::mstsc'
      - '::multirdp'
  selection_module_names:
    CommandLine|contains:
      - 'rpc::'
      - 'token::'
      - 'crypto::'
      - 'dpapi::'
      - 'sekurlsa::'
      - 'kerberos::'
      - 'lsadump::'
      - 'privilege::'
      - 'process::'
      - 'vault::'
  selection_tools_name:
    CommandLine|contains:
      - 'DumpCreds'
      - 'mimikatz'
  condition: 1 of selection_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Run mimikatz in interactive mode on the page for mimikatz

mimikatzIdentify

Enable debug privileges (needed for most operations) on the page for mimikatz

mimikatz "privilege::debug"Identify

Dump plaintext passwords, NTLM hashes, and Kerberos tickets from memory on the page for mimikatz

mimikatz "sekurlsa::logonpasswords"Identify

Pass-the-Hash with a specific NTLM hash and launch a command on the page for mimikatz

mimikatz "sekurlsa::pth /user:username /domain:domain /ntlm:hash /run:cmd"Identify

Dump local SAM database hashes on the page for mimikatz

mimikatz "lsadump::sam"Identify

Extract Kerberos tickets and export to a file on the page for mimikatz

mimikatz "kerberos::list /export"Identify

List cryptographic providers on the page for mimikatz-crypto

mimikatz "crypto::providers"Identify

List keys in a cryptographic provider on the page for mimikatz-crypto

mimikatz "crypto::capi"Identify

Export certificates and keys on the page for mimikatz-crypto

mimikatz "crypto::certificates /export"Identify

List master keys on the page for mimikatz-dpapi

mimikatz "dpapi::masterkey /list"Identify

Decrypt a DPAPI blob on the page for mimikatz-dpapi

mimikatz "dpapi::blob /in:blob_file.bin"Identify

Retrieve Chrome credentials using DPAPI on the page for mimikatz-dpapi

mimikatz "dpapi::chrome /in:Login Data"Identify

And 29 more examples on CmdID’s program pages.

ATT&CK

the techniques it is tagged with

T1003.001OS Credential Dumping: LSASS Memory

T1003.002OS Credential Dumping: Security Account Manager

T1003.004OS Credential Dumping: LSA Secrets

T1003.005OS Credential Dumping: Cached Domain Credentials

T1003.006OS Credential Dumping: DCSync

HackTool - Mimikatz Execution

What it looks for

Command lines that trip it

ATT&CK

Other rules for T1003.001 OS Credential Dumping: LSASS Memory