mimikatz

Hunt Hypothesis

This detection rule identifies adversaries leveraging Mimikatz to extract credentials from memory, a common tactic for lateral movement and privilege escalation within Azure environments. Proactive hunting is essential because successful credential theft enables attackers to bypass authentication controls and maintain persistent access across the tenant without triggering standard login alerts.

YARA Rule

rule mimikatz
{
	meta:
		description		= "mimikatz"
		author			= "Benjamin DELPY (gentilkiwi)"
		tool_author		= "Benjamin DELPY (gentilkiwi)"
      score          = 80
	strings:
		$exe_x86_1		= { 89 71 04 89 [0-3] 30 8d 04 bd }
		$exe_x86_2		= { 89 79 04 89 [0-3] 38 8d 04 b5 }

		$exe_x64_1		= { 4c 03 d8 49 [0-3] 8b 03 48 89 }
		$exe_x64_2		= { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }

		$dll_1			= { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }
		$dll_2			= { c7 0? 10 02 00 00 ?? 89 4? }

		$sys_x86		= { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
		$sys_x64		= { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }

	condition:
		(all of ($exe_x86_*)) or (all of ($exe_x64_*)) or (all of ($dll_*)) or (any of ($sys_*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Mimikatz detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Credential Harvesting via Scheduled Tasks

  • Context: IT Operations teams often schedule mimikatz.exe to run nightly via Windows Task Scheduler (e.g., TaskName: Nightly_Credential_Audit) to extract and rotate service account passwords or generate audit logs for compliance. These jobs run under a dedicated service account rather than an interactive user session.
  • Suggested Filter/Exclusion: Exclude alerts where the Parent_Process_Name is svchost.exe (specifically the TaskScheduler host) and the execution path matches the known tool directory, such as C:\Program Files\EnterpriseSecurity\Mimikatz\mimikatz.exe.
  • Filter Logic: (ProcessName == "mimikatz.exe") AND (ParentProcessName == "svchost.exe" OR ParentProcessName == "TaskScheduler.exe") AND (CommandLine CONTAINS "/scheduled")

• Scenario: Endpoint Security Tool Integration

  • Context: Enterprise EDR solutions like CrowdStrike Falcon, Carbon Black, or SentinelOne frequently bundle Mimikatz as a native module for their own “Live Response” features. When an analyst triggers a remote session to dump credentials, the EDR agent launches mimikatz.exe internally, which can look suspicious if not correlated with the parent agent process.
  • Suggested Filter/Exclusion: Create an exclusion rule that ignores mimikatz.exe instances where the parent process is a known security vendor executable (e.g., FalconSensorService.exe, cbengine.exe, or SentinelOneAgent.exe).
  • Filter Logic: `(ProcessName