Windows Event Logs: Mimikatz Keyword Indicators
Detects Mimikatz-related keywords in Windows event logs while filtering Sysmon EventID 15 to limit noise.
- Product
- windows
- Author
- Florian Roth (Nextron Systems), David ANDRE (additional keywords) (SigmaHQ), DRL 1.1
- Published
- 2017-01-10
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule looks for common Mimikatz-related command and module keywords in Windows event logs. Such strings often appear when an attacker executes credential access, lateral movement, or ticket manipulation activities using Mimikatz tooling. Detection relies on event log telemetry that preserves the relevant keyword text and filters out matches tied to Sysmon EventID 15 to reduce noise.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Event Logs: Mimikatz Keyword Indicators"
id: f8ef924a-a204-4d76-8938-3045a0f40f4e
status: test
description: This rule looks for common Mimikatz-related command and module keywords in Windows event logs. Such strings often appear when an attacker executes credential access, lateral movement, or ticket manipulation activities using Mimikatz tooling. Detection relies on event log telemetry that preserves the relevant keyword text and filters out matches tied to Sysmon EventID 15 to reduce noise.
references:
- https://tools.thehacker.recipes/mimikatz/modules
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_mimikatz_keywords.yml
author: Florian Roth (Nextron Systems), David ANDRE (additional keywords), Huntrule Team
date: 2017-01-10
modified: 2022-01-05
tags:
- attack.s0002
- attack.lateral-movement
- attack.credential-access
- car.2013-07-001
- car.2019-04-004
- attack.t1003.002
- attack.t1003.004
- attack.t1003.001
- attack.t1003.006
logsource:
product: windows
detection:
keywords:
- dpapi::masterkey
- eo.oe.kiwi
- event::clear
- event::drop
- gentilkiwi.com
- kerberos::golden
- kerberos::ptc
- kerberos::ptt
- kerberos::tgt
- Kiwi Legit Printer
- "lsadump::"
- mimidrv.sys
- \mimilib.dll
- misc::printnightmare
- misc::shadowcopies
- misc::skeleton
- privilege::backup
- privilege::debug
- privilege::driver
- "sekurlsa::"
filter:
EventID: 15
condition: keywords and not filter
falsepositives:
- Naughty administrators
- AV Signature updates
- Files with Mimikatz in their filename
level: high
license: DRL-1.1
related:
- id: 06d71506-7beb-4f22-8888-e2e5e2ca7fd8
type: derived