SigmaHQ/rules/windows/builtin/win_alert_mimikatz_keywords.yml

title: Mimikatz Usage
description: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
author: Florian Roth
logsource:
    product: windows
detection:
    selection:
        EventLog:
            - Security 
            - System
            - Application
            - Microsoft-Windows-Sysmon/Operational
    keywords:
        - mimikatz
        - mimilib
        - <3 eo.oe
        - eo.oe.kiwi
        - privilege::debug
        - sekurlsa::logonpasswords
        - lsadump::sam
        - mimidrv.sys
    condition: selection and 1 of keywords
falsepositives:
    - Naughty administrators
    - Penetration test
level: critical
Consistency between format description and examples - description/comment -> title/description - addition of reference 2017-01-10 21:40:59 +00:00			`title: Mimikatz Usage`
			`description: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`author: Florian Roth`
			`logsource:`
Removed lists from log source section 2017-02-19 10:08:23 +00:00			`product: windows`
Example Updates 2016-12-27 13:49:54 +00:00			`detection:`
			`selection:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`EventLog:`
			`- Security`
			`- System`
			`- Application`
			`- Microsoft-Windows-Sysmon/Operational`
Example Updates 2016-12-27 13:49:54 +00:00			`keywords:`
			`- mimikatz`
			`- mimilib`
			`- <3 eo.oe`
			`- eo.oe.kiwi`
			`- privilege::debug`
			`- sekurlsa::logonpasswords`
			`- lsadump::sam`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`- mimidrv.sys`
Remove implicit selection number, first Sysmon example 2017-01-10 14:05:19 +00:00			`condition: selection and 1 of keywords`
Example Updates 2016-12-27 13:49:54 +00:00			`falsepositives:`
			`- Naughty administrators`
Rule review * Typos * Added false positive descriptions 2017-02-24 22:44:42 +00:00			`- Penetration test`
Levels to low, medium, high, critical 2017-02-16 17:02:26 +00:00			`level: critical`