SigmaHQ/windows/builtin/alert_mimikatz_keywords.yml

description: Mimikatz Usage
comment: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
detection:
    selection:
        - EventLog:
              - Security 
              - System
              - Application
    keywords:
        - mimikatz
        - mimilib
        - <3 eo.oe
        - eo.oe.kiwi
        - privilege::debug
        - sekurlsa::logonpasswords
        - lsadump::sam
    condition: selection and 1 of keywords
falsepositives:
    - Naughty administrators
    - Penetraion test
level: 100
Example Updates 2016-12-27 13:49:54 +00:00			`description: Mimikatz Usage`
			`comment: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)`
			`detection:`
			`selection:`
Updated examples 2016-12-27 22:09:41 +00:00			`- EventLog:`
			`- Security`
			`- System`
			`- Application`
Example Updates 2016-12-27 13:49:54 +00:00			`keywords:`
			`- mimikatz`
			`- mimilib`
			`- <3 eo.oe`
			`- eo.oe.kiwi`
			`- privilege::debug`
			`- sekurlsa::logonpasswords`
			`- lsadump::sam`
Remove implicit selection number, first Sysmon example 2017-01-10 14:05:19 +00:00			`condition: selection and 1 of keywords`
Example Updates 2016-12-27 13:49:54 +00:00			`falsepositives:`
			`- Naughty administrators`
			`- Penetraion test`
			`level: 100`