Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation

Alerts on Windows file creation events for Mimikatz-related .kirbi and mimilsa.log files.

FreeReviewedSigma · Critical · v2

Product: windows
Category: file_event
Author: Florian Roth (Nextron Systems), David ANDRE (SigmaHQ), DRL 1.1
Published: 2021-11-08
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1558Steal or Forge Kerberos Tickets
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows file creation events where the target filename ends with artifacts associated with Mimikatz, including Kerberos ticket files (.kirbi) and MemSSP log output (mimilsa.log). Attackers may generate these files during credential access workflows, making them useful indicators of credential tooling on the host. It relies on file event telemetry that includes the created or written filename via a target filename field.

Reporting behind it

Related detections8 linkedT1558 — drag to rearrange

Malicious Kerberos proxiable/S4U2self Ticket - CVE-2021-42278/42287 (via security)

Malicious Rubeus Kerberos Unconstrained Delegation Abuse (via security)

Malicious Rubeus Kerberos Constrained Delegation Abuse - S4U2Proxy (via security)

Renamed Mimikatz Credential Theft Command Indicators (via process_creation)

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Windows Kerberos Replay Attack Likely Activity on Domain Controllers (Event ID 4649)

Windows: Uncommon Outbound Kerberos Traffic on Port 88

Antivirus Credential Dumping Signature Match (Password Dumpers/Stealers)

Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation

Pivot detection · T1558 · 8 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-hacktool-file-creation-mimikatz-kirbi-and-mimilsa-log-detection-9e099d99

title: "Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation"
id: 25213cb1-4ffd-426d-991f-69fef3ef37e1
related:
  - id: 034affe8-6170-11ec-844f-0f78aa0c4d66
    type: obsolete
  - id: 9e099d99-44c2-42b6-a6d8-54c3545cab29
    type: derived
status: test
description: This rule flags Windows file creation events where the target filename ends with artifacts associated with Mimikatz, including Kerberos ticket files (.kirbi) and MemSSP log output (mimilsa.log). Attackers may generate these files during credential access workflows, making them useful indicators of credential tooling on the host. It relies on file event telemetry that includes the created or written filename via a target filename field.
references:
  - https://cobalt.io/blog/kerberoast-attack-techniques
  - https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml
author: Florian Roth (Nextron Systems), David ANDRE, Huntrule Team
date: 2021-11-08
modified: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1558
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - .kirbi
      - mimilsa.log
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL