Windows Event Log Keyword Match for Mimikatz Credential Dumping and Kerberos Modules

title: Windows Event Log Keyword Match for Mimikatz Credential Dumping and Kerberos Modules
id: f8ef924a-a204-4d76-8938-3045a0f40f4e
status: test
description: This rule flags execution or artifacts associated with Mimikatz by matching a set of Mimikatz-specific keywords across Windows Event logs. Attackers use Mimikatz to extract credentials and manipulate authentication artifacts (for example, DPAPI and Kerberos operations), so keyword visibility in event telemetry can indicate malicious tool usage. It relies on Windows event data containing the specified strings while excluding events with EventID 15 to reduce false positives from Sysmon FileStream activity.
references:
  - https://tools.thehacker.recipes/mimikatz/modules
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_mimikatz_keywords.yml
author: Florian Roth (Nextron Systems), David ANDRE (additional keywords), Huntrule Team
date: 2017-01-10
modified: 2022-01-05
tags:
  - attack.s0002
  - attack.lateral-movement
  - attack.credential-access
  - car.2013-07-001
  - car.2019-04-004
  - attack.t1003.002
  - attack.t1003.004
  - attack.t1003.001
  - attack.t1003.006
logsource:
  product: windows
detection:
  keywords:
    - dpapi::masterkey
    - eo.oe.kiwi
    - event::clear
    - event::drop
    - gentilkiwi.com
    - kerberos::golden
    - kerberos::ptc
    - kerberos::ptt
    - kerberos::tgt
    - Kiwi Legit Printer
    - "lsadump::"
    - mimidrv.sys
    - \mimilib.dll
    - misc::printnightmare
    - misc::shadowcopies
    - misc::skeleton
    - privilege::backup
    - privilege::debug
    - privilege::driver
    - "sekurlsa::"
  filter:
    EventID: 15
  condition: keywords and not filter
falsepositives:
  - Naughty administrators
  - AV Signature updates
  - Files with Mimikatz in their filename
level: high
license: DRL-1.1
related:
  - id: 06d71506-7beb-4f22-8888-e2e5e2ca7fd8
    type: derived