SigmaHQ/rules/windows/sysmon/sysmon_ghostpack_safetykatz.yml

title: Detection of SafetyKatz
status: experimental
description: Detects possible SafetyKatz Behaviour
references:
    - https://github.com/GhostPack/SafetyKatz
tags:
    - attack.credential_access
    - attack.t1003
author: Markus Neis
date: 2018/07/24
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename: '*\Temp\debug.bin'
    condition: selection
falsepositives:
    - Unknown
level: high
Possible SafetyKatz Dump of debug.bin https://github.com/GhostPack/SafetyKatz 2018-07-24 21:51:46 +00:00			`title: Detection of SafetyKatz`
			`status: experimental`
			`description: Detects possible SafetyKatz Behaviour`
			`references:`
			`- https://github.com/GhostPack/SafetyKatz`
			`tags:`
			`- attack.credential_access`
Correct MITRE tag 2019-01-22 18:26:07 +00:00			`- attack.t1003`
Possible SafetyKatz Dump of debug.bin https://github.com/GhostPack/SafetyKatz 2018-07-24 21:51:46 +00:00			`author: Markus Neis`
atc review 2019-03-06 04:25:12 +00:00			`date: 2018/07/24`
Possible SafetyKatz Dump of debug.bin https://github.com/GhostPack/SafetyKatz 2018-07-24 21:51:46 +00:00			`logsource:`
			`product: windows`
			`service: sysmon`
			`detection:`
			`selection:`
			`EventID: 11`
Cosmetics If it's only 1 value we write it like this to avoid it being interpreted as a list with 1 element and to avoid an extra line. 2018-07-25 05:37:17 +00:00			`TargetFilename: '*\Temp\debug.bin'`
Possible SafetyKatz Dump of debug.bin https://github.com/GhostPack/SafetyKatz 2018-07-24 21:51:46 +00:00			`condition: selection`
			`falsepositives:`
			`- Unknown`
			`level: high`