Detects password dumper mimikatz in memory

Hunt Hypothesis

This hunt hypothesis targets adversaries executing Mimikatz in memory to extract credentials from the LSASS process without leaving traditional file-based artifacts on disk. Proactive hunting for this behavior is critical within Azure Sentinel because memory-only execution often bypasses standard file integrity monitoring, allowing attackers to silently harvest sensitive authentication data before lateral movement occurs.

YARA Rule

rule Mimikatz_Memory_Rule_1 : APT {
	meta:
		author = "Florian Roth"
		date = "12/22/2014"
		score = 70
		type = "memory"
		description = "Detects password dumper mimikatz in memory"
	strings:
		$s1 = "sekurlsa::msv" fullword ascii
	    $s2 = "sekurlsa::wdigest" fullword ascii
	    $s4 = "sekurlsa::kerberos" fullword ascii
	    $s5 = "sekurlsa::tspkg" fullword ascii
	    $s6 = "sekurlsa::livessp" fullword ascii
	    $s7 = "sekurlsa::ssp" fullword ascii
	    $s8 = "sekurlsa::logonPasswords" fullword ascii
	    $s9 = "sekurlsa::process" fullword ascii
	    $s10 = "ekurlsa::minidump" fullword ascii
	    $s11 = "sekurlsa::pth" fullword ascii
	    $s12 = "sekurlsa::tickets" fullword ascii
	    $s13 = "sekurlsa::ekeys" fullword ascii
	    $s14 = "sekurlsa::dpapi" fullword ascii
	    $s15 = "sekurlsa::credman" fullword ascii
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 14 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects password dumper mimikatz in memory” rule, along with suggested filters and exclusions:

• Scenario: Scheduled Security Audits by Third-Party Tools

  • Context: Enterprise security teams often run scheduled vulnerability assessments or compliance audits using tools like Qualys, Tenable Nessus, or SolarWinds PAM. These agents frequently inject mimikatz.exe (or its DLL components) into the memory of domain controllers and member servers to extract credential hashes for analysis.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Image Path matching known security agent directories (e.g., C:\Program Files\Qualys\Agent\...) AND the Parent Process Name being the specific agent service (e.g., qualyspc.exe or tenable_agent.exe).

• Scenario: Automated Password Rotation Scripts via PowerShell

  • Context: IT Operations teams utilize automated scripts to rotate privileged account passwords. These scripts, often written in PowerShell, invoke mimikatz.exe as a child process to dump current credentials before applying the new password hash. This is common on Domain Controllers during off-hours maintenance windows.
  • Suggested Filter/Exclusion: Exclude events where the Parent Process Name is powershell.exe AND the Command Line contains specific keywords related to rotation (e.g., -Rotation, -AutoUpdate) or runs within a defined time window (e.g., 02:00–04:00 AM local time).

• Scenario: On-Demand Forensic Investigation by SOC Analysts

  • Context: When investigating an active incident, SOC analysts manually launch mimikatz.exe from a jump box or directly on the target host