Mimikatz Rule generated from a memory dump

Hunt Hypothesis

This detection identifies adversaries executing Mimikatz to extract credentials and secrets directly from system memory, a technique frequently used during post-compromise lateral movement. SOC teams should proactively hunt for this activity in Azure Sentinel because memory dumping is often a precursor to credential theft that can lead to domain-wide compromise if not immediately contained.

YARA Rule

rule Mimikatz_Memory_Rule_2 : APT {
	meta:
		description = "Mimikatz Rule generated from a memory dump"
		author = "Florian Roth - Florian Roth"
		type = "memory"
		score = 80
	strings:
		$s0 = "sekurlsa::" ascii
		$x1 = "cryptprimitives.pdb" ascii
		$x2 = "Now is t1O" ascii fullword
		$x4 = "ALICE123" ascii
		$x5 = "BOBBY456" ascii
	condition:
		$s0 and 1 of ($x*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Mimikatz Rule generated from a memory dump, including targeted filters and exclusions:

• Scheduled Credential Harvesting by Backup Agents

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault often run scheduled jobs that perform memory dumps of domain controllers to capture live credentials for disaster recovery. These agents may invoke mimikatz.exe (or a similar binary) as part of their credential extraction routine, triggering the rule even though no human interaction occurred.
  • Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. Exclude events where the parent process is Veeam.Backup.Service.exe or commvault.cmd and the executable path matches the known backup agent installation directory (e.g., C:\Program Files\Veeam\Backup and Replication\...).

• Automated Onboarding Scripts via PowerShell

  • Scenario: During new employee onboarding, IT operations teams often run automated PowerShell scripts that utilize Mimikatz to extract domain credentials for provisioning services. These scripts are typically triggered by System Center Configuration Manager (SCCM) or Ansible Tower, launching mimikatz.exe with specific command-line arguments in a non-interactive session.
  • Filter/Exclusion: Filter based on the Command Line argument and User Context. Exclude alerts where the user context is SYSTEM or a dedicated service account (e.g., svc-onboarding) and the command line contains specific flags like /quiet, /script, or references to internal script paths (e.g., C:\Scripts\Onboard\Mimikatz.ps1).

• Endpoint Detection and Response (EDR) Health Checks

  • Scenario: Advanced EDR platforms