{"id":"9e099d99-44c2-42b6-a6d8-54c3545cab29","title":"HackTool - Mimikatz Kirbi File Creation","description":"Detects the creation of files created by mimikatz such as \".kirbi\", \"mimilsa.log\", etc.","author":"Florian Roth (Nextron Systems), David ANDRE","status":"test","level":"critical","date":"2021-11-08","modified":"2024-06-27","tags":["attack.credential-access","attack.t1558"],"technique_ids":["T1558"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Unlikely"],"references":["https://cobalt.io/blog/kerberoast-attack-techniques","https://pentestlab.blog/2019/10/21/persistence-security-support-provider/"],"source_path":"rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml","source_sha256":"0f6eeec794001fa74bb294acfe2130656d138de6806ae1faa5f63d4078aa999f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Mimikatz Kirbi File Creation\nid: 9e099d99-44c2-42b6-a6d8-54c3545cab29\nrelated:\n    - id: 034affe8-6170-11ec-844f-0f78aa0c4d66\n      type: obsolete\nstatus: test\ndescription: Detects the creation of files created by mimikatz such as \".kirbi\", \"mimilsa.log\", etc.\nreferences:\n    - https://cobalt.io/blog/kerberoast-attack-techniques\n    - https://pentestlab.blog/2019/10/21/persistence-security-support-provider/\nauthor: Florian Roth (Nextron Systems), David ANDRE\ndate: 2021-11-08\nmodified: 2024-06-27\ntags:\n    - attack.credential-access\n    - attack.t1558\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|endswith:\n            - '.kirbi' # Kerberos tickets\n            - 'mimilsa.log' # MemSSP default file\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: critical\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1558","id":"T1558","name":"Steal or Forge Kerberos Tickets","page":"techniques/enterprise/T1558/"}],"data_path":"data/detection-rules/9e099d99-44c2-42b6-a6d8-54c3545cab29.json","kind":"sigma"}