name: Windows Mimikatz Binary Execution
id: a9e0d6d3-9676-4e26-994d-4e0406bb4467
version: 1
date: '2022-11-16'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: As simple as it sounds, this analytic identifies when the native mimikatz.exe binary executes on Windows. It does look for the original file name as well, just in case the binary is renamed.
  Adversaries sometimes bring in the default binary and run it directly.
  Benjamin Delpy originally created Mimikatz as a proof of concept to show Microsoft that its authentication protocols were vulnerable to an attack. Instead, he inadvertently created one of the most widely used and downloaded threat actor tools of the past 20 years.
  Mimikatz is an open-source application that allows users to view and save authentication credentials such as Kerberos tickets.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=mimikatz.exe OR Processes.original_file_name=mimikatz.exe)
  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
  Processes.process Processes.process_id Processes.parent_process_id
  | `drop_dm_object_name(Processes)` 
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `windows_mimikatz_binary_execution_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives should be limited as this is directly looking for Mimikatz, the credential dumping utility.
references:
  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
  - https://www.varonis.com/blog/what-is-mimikatz
tags:
  analytic_story:
  - Credential Dumping
  - CISA AA22-320A
  asset_type: Endpoint
  cis20:
  - CIS 3
  - CIS 5
  - CIS 16
  confidence: 100
  context:
  - Source:Endpoint
  - Stage:Credential Access
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon.log
  impact: 100
  kill_chain_phases:
  - Exploitation
  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting dump credentials.
  mitre_attack_id:
  - T1003
  nist:
  - DE.CM
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: Computer
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.dest
  - Processes.user
  - Processes.parent_process_name #parent process name
  - Processes.parent_process #parent cmdline
  - Processes.original_file_name
  - Processes.process_name #process name
  - Processes.process #process cmdline
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 100
  security_domain: endpoint