Windows HackTool File Creation: Mimikatz .kirbi and mimilsa.log Detection

title: "Windows HackTool File Creation: Mimikatz .kirbi and mimilsa.log Detection"
id: 25213cb1-4ffd-426d-991f-69fef3ef37e1
related:
  - id: 034affe8-6170-11ec-844f-0f78aa0c4d66
    type: obsolete
  - id: 9e099d99-44c2-42b6-a6d8-54c3545cab29
    type: derived
status: test
description: This rule flags creation of specific files commonly associated with Mimikatz, including Kerberos ticket files ending in .kirbi and a MemSSP-related log named mimilsa.log. Such artifacts can indicate credential access and Kerberos ticket handling, which attackers use to impersonate users or access protected resources. It relies on Windows file creation telemetry that provides the target filename of the created file.
references:
  - https://cobalt.io/blog/kerberoast-attack-techniques
  - https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml
author: Florian Roth (Nextron Systems), David ANDRE, Huntrule Team
date: 2021-11-08
modified: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1558
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - .kirbi
      - mimilsa.log
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1