SigmaHQ/rules/windows/sysmon/sysmon_mimikatz_inmemory_detection.yml

title: Mimikatz In-Memory Detection
status: experimental
description: Detects certain DLL loads when Mimikatz gets executed
reference: https://securityriskadvisors.com/blog/post/detecting-in-memory-mimikatz/
logsource:
    product: windows
    service: sysmon
detection:
    selector:
        EventID: 7
        Image: 'C:\Windows\System32\rundll32.exe'
    dllload1:
        ImageLoaded: '*\vaultcli.dll'
    dllload2:
        ImageLoaded: '*\wlanapi.dll'        
    exclusion:
        ImageLoaded:
            - 'ntdsapi.dll'
            - 'netapi32.dll'
            - 'imm32.dll'
            - 'samlib.dll'
            - 'combase.dll'
            - 'srvcli.dll'
            - 'shcore.dll'
            - 'ntasn1.dll'
            - 'cryptdll.dll'
            - 'logoncli.dll'
    timeframe: last 30s
    condition: selector | near dllload1 and dllload2 and not exclusion within timeframe
falsepositives:
    - unknown
level: medium
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`title: Mimikatz In-Memory Detection`
			`status: experimental`
			`description: Detects certain DLL loads when Mimikatz gets executed`
			`reference: https://securityriskadvisors.com/blog/post/detecting-in-memory-mimikatz/`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`logsource:`
Sysmon as 'service' of product 'windows' 2017-03-13 08:23:08 +00:00			`product: windows`
			`service: sysmon`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`detection:`
Proposed changes to mimimkatz-inmemory aggregation 2017-03-01 09:16:43 +00:00			`selector:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`EventID: 7`
			`Image: 'C:\Windows\System32\rundll32.exe'`
Proposed changes to mimimkatz-inmemory aggregation 2017-03-01 09:16:43 +00:00			`dllload1:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`ImageLoaded: '*\vaultcli.dll'`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`dllload2:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`ImageLoaded: '*\wlanapi.dll'`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`exclusion:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`ImageLoaded:`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`- 'ntdsapi.dll'`
			`- 'netapi32.dll'`
			`- 'imm32.dll'`
			`- 'samlib.dll'`
			`- 'combase.dll'`
			`- 'srvcli.dll'`
			`- 'shcore.dll'`
			`- 'ntasn1.dll'`
			`- 'cryptdll.dll'`
			`- 'logoncli.dll'`
			`timeframe: last 30s`
Parsing of "near ... within" aggregation operator * Operator is only parsed. No processing or passing of parsed data to backends. * Changed rule sysmon_mimikatz_inmemory_detection.yml accordingly. 2017-08-02 22:05:48 +00:00			`condition: selector \| near dllload1 and dllload2 and not exclusion within timeframe`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`falsepositives:`
			`- unknown`
Parsing of "near ... within" aggregation operator * Operator is only parsed. No processing or passing of parsed data to backends. * Changed rule sysmon_mimikatz_inmemory_detection.yml accordingly. 2017-08-02 22:05:48 +00:00			`level: medium`