Windows Event Logs: Mimikatz Keyword Indicators

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule looks for common Mimikatz-related command and module keywords in Windows event logs. Such strings often appear when an attacker executes credential access, lateral movement, or ticket manipulation activities using Mimikatz tooling. Detection relies on event log telemetry that preserves the relevant keyword text and filters out matches tied to Sysmon EventID 15 to reduce noise.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange

Windows Process Creation: Detect Mimikatz Tool and Module Command-Line Usage

Windows System Service Execution of Credential Dumping Tools (Service Control Manager Event 7045)

Windows Security EID 4697 Service Execution of Credential Dumping Tools

Windows PUA: MemProcFS memory dump mounting via -device

Windows Credential Dump Tool Artifacts Written to Disk via File Events

Windows Named Pipe Creation for Known Credential Dumping Tool Pipe Names

Malicious Mimikatz Credential Access Module Invocation

Zeek SMB: Network Share File Transfers of Credential-Related Filenames

Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers

Windows Event Logs: Mimikatz Keyword Indicators

Pivot detection · T1003.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-event-log-keyword-match-for-mimikatz-credential-dumping-and-kerberos-mod-06d71506

title: "Windows Event Logs: Mimikatz Keyword Indicators"
id: f8ef924a-a204-4d76-8938-3045a0f40f4e
status: test
description: This rule looks for common Mimikatz-related command and module keywords in Windows event logs. Such strings often appear when an attacker executes credential access, lateral movement, or ticket manipulation activities using Mimikatz tooling. Detection relies on event log telemetry that preserves the relevant keyword text and filters out matches tied to Sysmon EventID 15 to reduce noise.
references:
  - https://tools.thehacker.recipes/mimikatz/modules
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_mimikatz_keywords.yml
author: Florian Roth (Nextron Systems), David ANDRE (additional keywords), Huntrule Team
date: 2017-01-10
modified: 2022-01-05
tags:
  - attack.s0002
  - attack.lateral-movement
  - attack.credential-access
  - car.2013-07-001
  - car.2019-04-004
  - attack.t1003.002
  - attack.t1003.004
  - attack.t1003.001
  - attack.t1003.006
logsource:
  product: windows
detection:
  keywords:
    - dpapi::masterkey
    - eo.oe.kiwi
    - event::clear
    - event::drop
    - gentilkiwi.com
    - kerberos::golden
    - kerberos::ptc
    - kerberos::ptt
    - kerberos::tgt
    - Kiwi Legit Printer
    - "lsadump::"
    - mimidrv.sys
    - \mimilib.dll
    - misc::printnightmare
    - misc::shadowcopies
    - misc::skeleton
    - privilege::backup
    - privilege::debug
    - privilege::driver
    - "sekurlsa::"
  filter:
    EventID: 15
  condition: keywords and not filter
falsepositives:
  - Naughty administrators
  - AV Signature updates
  - Files with Mimikatz in their filename
level: high
license: DRL-1.1
related:
  - id: 06d71506-7beb-4f22-8888-e2e5e2ca7fd8
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL