Potential Invoke-Mimikatz PowerShell Script

 1[metadata]
 2creation_date = "2020/12/07"
 3integration = ["windows"]
 4maturity = "production"
 5updated_date = "2024/10/28"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many
13other features that make it useful for testing the security of networks. This rule detects Invoke-Mimikatz PowerShell
14script and alike.
15"""
16from = "now-9m"
17index = ["winlogbeat-*", "logs-windows.powershell*"]
18language = "kuery"
19license = "Elastic License v2"
20name = "Potential Invoke-Mimikatz PowerShell Script"
21note = """## Triage and analysis
22
23### Investigating Mimikatz PowerShell Activity
24
25[Mimikatz](https://github.com/gentilkiwi/mimikatz) is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to move laterally and pivot across a network.
26
27This rule looks for PowerShell scripts that load mimikatz in memory, like Invoke-Mimikataz, which are used to dump credentials from the Local Security Authority Subsystem Service (LSASS). Any activity triggered from this rule should be treated with high priority as it typically represents an active adversary.
28
29More information about Mimikatz components and how to detect/prevent them can be found on [ADSecurity](https://adsecurity.org/?page_id=1821).
30
31#### Possible investigation steps
32
33- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
34- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
35- Examine file or network events from the involved PowerShell process for suspicious behavior.
36- Investigate other alerts associated with the user/host during the past 48 hours.
37  - Invoke-Mimitakz and alike scripts heavily use other capabilities covered by other detections described in the "Related Rules" section.
38- Evaluate whether the user needs to use PowerShell to complete tasks.
39- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host.
40  - Examine network and security events in the environment to identify potential lateral movement using compromised credentials.
41
42### False positive analysis
43
44- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
45
46### Related rules
47
48- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
49- Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
50- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
51- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
52- Mimikatz Memssp Log File Detected - ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6
53- Modification of WDigest Security Provider - d703a5af-d5b0-43bd-8ddb-7a5d500b7da5
54
55### Response and remediation
56
57- Initiate the incident response process based on the outcome of the triage.
58- Isolate the involved host to prevent further post-compromise behavior.
59- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
60- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
61- Validate that cleartext passwords are disabled in memory for use with `WDigest`.
62- Look into preventing access to `LSASS` using capabilities such as LSA protection or antivirus/EDR tools that provide this capability.
63- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
64- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
65- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
66"""
67references = [
68    "https://attack.mitre.org/software/S0002/",
69    "https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1",
70    "https://www.elastic.co/security-labs/detect-credential-access",
71]
72risk_score = 73
73rule_id = "ac96ceb8-4399-4191-af1d-4feeac1f1f46"
74setup = """## Setup
75
76The 'PowerShell Script Block Logging' logging policy must be configured (Enable).
77
78Steps to implement the logging policy with Advanced Audit Configuration:

1
2Steps to implement the logging policy via registry:

 1"""
 2severity = "high"
 3tags = [
 4    "Domain: Endpoint",
 5    "OS: Windows",
 6    "Use Case: Threat Detection",
 7    "Tactic: Credential Access",
 8    "Resources: Investigation Guide",
 9    "Data Source: PowerShell Logs",
10]
11timestamp_override = "event.ingested"
12type = "query"
13
14query = '''
15event.category:process and host.os.type:windows and
16powershell.file.script_block_text:(
17  (DumpCreds and
18  DumpCerts) or
19  "sekurlsa::logonpasswords" or
20  ("crypto::certificates" and
21  "CERT_SYSTEM_STORE_LOCAL_MACHINE")
22)
23'''
24
25
26[[rule.threat]]
27framework = "MITRE ATT&CK"
28[[rule.threat.technique]]
29id = "T1003"
30name = "OS Credential Dumping"
31reference = "https://attack.mitre.org/techniques/T1003/"
32[[rule.threat.technique.subtechnique]]
33id = "T1003.001"
34name = "LSASS Memory"
35reference = "https://attack.mitre.org/techniques/T1003/001/"
36
37
38
39[rule.threat.tactic]
40id = "TA0006"
41name = "Credential Access"
42reference = "https://attack.mitre.org/tactics/TA0006/"