{"id":"189e3b02-82b2-4b90-9662-411eb64486d4","title":"Potential Invoke-Mimikatz PowerShell Script","description":"Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.","author":"Tim Rauch, Elastic (idea)","status":"test","level":"high","date":"2022-09-28","modified":"","tags":["attack.credential-access","attack.t1003"],"technique_ids":["T1003"],"logsource":{"category":"ps_script","product":"windows"},"falsepositives":["Mimikatz can be useful for testing the security of networks"],"references":["https://www.elastic.co/guide/en/security/current/potential-invoke-mimikatz-powershell-script.html#potential-invoke-mimikatz-powershell-script"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml","source_sha256":"69247510cbdaf2b155e99cffd1d11c4a39d875e84c43c163a9f52cbcd34a1cda","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Invoke-Mimikatz PowerShell Script\nid: 189e3b02-82b2-4b90-9662-411eb64486d4\nstatus: test\ndescription: Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.\nreferences:\n    - https://www.elastic.co/guide/en/security/current/potential-invoke-mimikatz-powershell-script.html#potential-invoke-mimikatz-powershell-script\nauthor: Tim Rauch, Elastic (idea)\ndate: 2022-09-28\ntags:\n    - attack.credential-access\n    - attack.t1003\nlogsource:\n    category: ps_script\n    product: windows\ndetection:\n    selection_1:\n        ScriptBlockText|contains|all:\n            - 'DumpCreds'\n            - 'DumpCerts'\n    selection_2:\n        ScriptBlockText|contains: 'sekurlsa::logonpasswords'\n    selection_3:\n        ScriptBlockText|contains|all:\n            - 'crypto::certificates'\n            - 'CERT_SYSTEM_STORE_LOCAL_MACHINE'\n    condition: 1 of selection*\nfalsepositives:\n    - Mimikatz can be useful for testing the security of networks\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"}],"data_path":"data/detection-rules/189e3b02-82b2-4b90-9662-411eb64486d4.json","kind":"sigma"}