Elastic Defend high stable eql

Potential Credential Access via Mimikatz

Identifies the usage of Mimikatz using known malicious command line arguments. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks.

View Source

Detection Logic

process where event.action == "start" and
  process.args : (
    "privilege::debug",
    "sekurlsa::logonpasswords",
    "sekurlsa::pth",
    "lsadump::sam",
    "lsadump::dcsync",
    "vault::cred",
    "vault::list",
    "token::elevate",
    "/user:krbtgt",
    "kerberos::tgt",
    "kerberos::ptt",
    "kerberos::list",
    "misc::memssp"
  )

Field Validations

Loading…

Comments (0)

Loading comments...