Query: write Sigma for This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that ar
Matching passage: Sigma rule: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that ar. Logsource: windows. Rule: title: Mimikatz Use id: 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 status: test description: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups) references: - https://tools.thehacker.recipes/mimikatz/modules author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) date: 2017-01-10 modified: 2022-01-05 tags: - attack.s0002 - attack.lateral-movement - attack.credential-access - car.2013-07-001 - car.2019-04-004 - attack.t1003.002 - attack.t1003.004 - attack.t1003.001 - attack.t1003.006 logsource: product: windows detection: keywords: - dpapi::masterkey - eo.oe.kiwi - event::clear - event::drop - gentilkiwi.com - kerberos::golden - kerberos::ptc - kerberos::ptt - kerberos::tgt - Kiwi Legit Printer - 'lsadump::' - mimidrv.sys - \mimilib.dll - misc::printnightmare - misc::shadowcopies - misc::skeleton - privilege::backup - privilege::debug - privilege::driver - 'sekurlsa::' filter: EventID: 15 condition: keywords and not filter falsepositives: - Naughty administrators - AV Signature updates - Files with Mimikatz in their filename level: high
Near-miss passage: Sigma rule: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName data. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Via Binary Rename id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142 related: - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e type: similar status: test description: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint. references: - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html author: Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades) date: 2019-06-15 modified: 2026-06-05 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: OriginalFileName: - Cmd.Exe - CONHOST.EXE - 7z.exe - 7za.exe - 7zr.exe - WinRAR.exe - wevtutil.exe - net.exe - net1.exe - netsh.exe - InstallUtil.exe filter: Image|endswith: - \cmd.exe - \conhost.exe - \7z.exe - \7za.exe - \7zr.exe - \WinRAR.exe - \wevtutil.exe - \net.exe - \net1.exe - \netsh.exe - \InstallUtil.exe condition: selection and not filter falsepositives: - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary/info.yml