Elastic critical stable kql

Potential Invoke-Mimikatz PowerShell Script

Identifies PowerShell script block content containing Invoke-Mimikatz or Mimikatz commands used to dump credentials, extract password stores, export certificates, or use alternate authentication material. These patterns can indicate in-memory credential access and require reconstructed script context and follow-on telemetry to assess impact.

View Source

Detection Logic

event.category:process and host.os.type:windows and
powershell.file.script_block_text:(
  (DumpCreds and DumpCerts) or
  "sekurlsa::logonpasswords" or
  "sekurlsa::ekeys" or
  "sekurlsa::tickets" or
  "sekurlsa::pth" or
  "sekurlsa::minidump" or
  "lsadump::sam" or
  "lsadump::secrets" or
  "lsadump::cache" or
  "lsadump::dcsync" or
  "vault::cred" or
  "dpapi::cred" or
  ("crypto::certificates" and
  "CERT_SYSTEM_STORE_LOCAL_MACHINE")
)

Field Validations

Loading…

Comments (0)

Loading comments...