Detects a log file generated by malicious hack tool mimikatz

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Mimikatz to harvest credentials and dump memory secrets from compromised endpoints within the Azure Sentinel environment. Proactive hunting is essential because Mimikatz is a ubiquitous post-exploitation tool often used in lateral movement attacks, making its detection critical for preventing credential theft and subsequent privilege escalation.

YARA Rule

rule Mimikatz_Logfile
{
	meta:
		description = "Detects a log file generated by malicious hack tool mimikatz"
		author = "Florian Roth"
		score = 80
		date = "2015/03/31"
		reference = "https://github.com/Neo23x0/Loki/blob/master/signatures/thor-hacktools.yar"
	strings:
		$s1 = "SID               :" ascii fullword
		$s2 = "* NTLM     :" ascii fullword
		$s3 = "Authentication Id :" ascii fullword
		$s4 = "wdigest :" ascii fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://github.com/Neo23x0/Loki/blob/master/signatures/thor-hacktools.yar
• Source Rule

False Positive Guidance

• Scenario: The IT Operations team runs a scheduled PowerShell job using the Invoke-Mimikatz cmdlet to perform routine credential auditing and password policy compliance checks on domain controllers during off-hours. This legitimate activity generates log files identical in structure to those created by an attacker running Mimikatz for lateral movement.

  • Filter/Exclusion: Create a rule exclusion based on the ProcessName matching powershell.exe where the command line contains specific audit keywords (e.g., -AuditCompliance) and restricts matches to a defined list of trusted Service Accounts (e.g., svc-audit-bot).

• Scenario: The Security Operations Center utilizes a third-party endpoint detection tool, such as CrowdStrike Falcon or Microsoft Defender for Identity, which internally invokes Mimikatz modules via the lsass.exe process to extract and analyze session tokens for real-time threat hunting. This internal scanning generates log artifacts that mimic malicious activity.

  • Filter/Exclusion: Exclude events where the parent process is a known security vendor executable (e.g., FalconSensorService.exe, MsMpEng.exe) or where the user context belongs to the specific “Security Monitoring” group, ensuring internal scans do not trigger alerts.

• Scenario: During quarterly maintenance windows, System Administrators manually execute Mimikatz via a custom administrative script (C:\Scripts\WeeklyHealthCheck.ps1) to dump memory dumps and verify Kerberos ticket integrity on critical servers. This manual execution creates the specific log file signature detected by the rule.

  • Filter/Exclusion: Implement a time-based filter that suppresses alerts for this rule during defined maintenance windows (e.g., Sundays 02:00–04:00 UTC) or exclude events where the CommandLine argument contains the specific script path C:\Scripts\WeeklyHealthCheck.ps1.