Windows Process Command Line Indicators for Mimikatz Tool Execution and Credential Dump Modules

Flags Windows processes whose command lines contain Mimikatz names and credential-dumping module/function arguments.

FreeUnreviewedSigmahighv1

windows-process-command-line-indicators-for-mimikatz-tool-execution-and-credenti-a642964e

title: Windows Process Command Line Indicators for Mimikatz Tool Execution and Credential Dump Modules
id: 7bbb777d-78d5-4af4-8582-7f43dcec4d30
status: test
description: This rule identifies Windows process creation command lines containing common Mimikatz identifiers and module/function markers used in credential-access activity. Attackers rely on Mimikatz-style arguments (e.g., DumpCreds or module namespaces like sekurlsa::, dpapi::, lsadump::, vault::) to enumerate credentials and access sensitive material. It uses Windows process command-line telemetry and matches partial string patterns across the full command line.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://tools.thehacker.recipes/mimikatz/modules
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml
author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton, Huntrule Team
date: 2019-10-22
modified: 2023-02-21
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.t1003.002
  - attack.t1003.004
  - attack.t1003.005
  - attack.t1003.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools_name:
    CommandLine|contains:
      - DumpCreds
      - mimikatz
  selection_function_names:
    CommandLine|contains:
      - ::aadcookie
      - ::detours
      - ::memssp
      - ::mflt
      - ::ncroutemon
      - ::ngcsign
      - ::printnightmare
      - ::skeleton
      - ::preshutdown
      - ::mstsc
      - ::multirdp
  selection_module_names:
    CommandLine|contains:
      - "rpc::"
      - "token::"
      - "crypto::"
      - "dpapi::"
      - "sekurlsa::"
      - "kerberos::"
      - "lsadump::"
      - "privilege::"
      - "process::"
      - "vault::"
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a642964e-bead-4bed-8910-1bb4d63e3b4d
    type: derived

What it detects

This rule identifies Windows process creation command lines containing common Mimikatz identifiers and module/function markers used in credential-access activity. Attackers rely on Mimikatz-style arguments (e.g., DumpCreds or module namespaces like sekurlsa::, dpapi::, lsadump::, vault::) to enumerate credentials and access sensitive material. It uses Windows process command-line telemetry and matches partial string patterns across the full command line.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.