Potential Invoke-Mimikatz PowerShell Script

 1[metadata]
 2creation_date = "2020/12/07"
 3integration = ["windows"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many
11other features that make it useful for testing the security of networks. This rule detects Invoke-Mimikatz PowerShell
12script and alike.
13"""
14from = "now-9m"
15index = ["winlogbeat-*", "logs-windows.powershell*"]
16language = "kuery"
17license = "Elastic License v2"
18name = "Potential Invoke-Mimikatz PowerShell Script"
19note = """## Triage and analysis
20
21### Investigating Mimikatz PowerShell Activity
22
23[Mimikatz](https://github.com/gentilkiwi/mimikatz) is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to move laterally and pivot across a network.
24
25This rule looks for PowerShell scripts that load mimikatz in memory, like Invoke-Mimikataz, which are used to dump credentials from the Local Security Authority Subsystem Service (LSASS). Any activity triggered from this rule should be treated with high priority as it typically represents an active adversary.
26
27More information about Mimikatz components and how to detect/prevent them can be found on [ADSecurity](https://adsecurity.org/?page_id=1821).
28
29#### Possible investigation steps
30
31- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
32- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
33- Examine file or network events from the involved PowerShell process for suspicious behavior.
34- Investigate other alerts associated with the user/host during the past 48 hours.
35  - Invoke-Mimitakz and alike scripts heavily use other capabilities covered by other detections described in the "Related Rules" section.
36- Evaluate whether the user needs to use PowerShell to complete tasks.
37- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host.
38  - Examine network and security events in the environment to identify potential lateral movement using compromised credentials.
39
40### False positive analysis
41
42- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
43
44### Related rules
45
46- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
47- Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
48- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
49- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
50- Mimikatz Memssp Log File Detected - ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6
51- Modification of WDigest Security Provider - d703a5af-d5b0-43bd-8ddb-7a5d500b7da5
52
53### Response and remediation
54
55- Initiate the incident response process based on the outcome of the triage.
56- Isolate the involved host to prevent further post-compromise behavior.
57- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
58- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
59- Validate that cleartext passwords are disabled in memory for use with `WDigest`.
60- Look into preventing access to `LSASS` using capabilities such as LSA protection or antivirus/EDR tools that provide this capability.
61- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
62- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
63- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
64"""
65references = [
66    "https://attack.mitre.org/software/S0002/",
67    "https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1",
68    "https://www.elastic.co/security-labs/detect-credential-access",
69]
70risk_score = 73
71rule_id = "ac96ceb8-4399-4191-af1d-4feeac1f1f46"
72setup = """## Setup
73
74The 'PowerShell Script Block Logging' logging policy must be configured (Enable).
75
76Steps to implement the logging policy with Advanced Audit Configuration:

1
2Steps to implement the logging policy via registry:

 1"""
 2severity = "high"
 3tags = [
 4    "Domain: Endpoint",
 5    "OS: Windows",
 6    "Use Case: Threat Detection",
 7    "Tactic: Credential Access",
 8    "Resources: Investigation Guide",
 9    "Data Source: PowerShell Logs",
10]
11timestamp_override = "event.ingested"
12type = "query"
13
14query = '''
15event.category:process and host.os.type:windows and
16powershell.file.script_block_text:(
17  (DumpCreds and
18  DumpCerts) or
19  "sekurlsa::logonpasswords" or
20  ("crypto::certificates" and
21  "CERT_SYSTEM_STORE_LOCAL_MACHINE")
22)
23'''
24
25
26[[rule.threat]]
27framework = "MITRE ATT&CK"
28[[rule.threat.technique]]
29id = "T1003"
30name = "OS Credential Dumping"
31reference = "https://attack.mitre.org/techniques/T1003/"
32[[rule.threat.technique.subtechnique]]
33id = "T1003.001"
34name = "LSASS Memory"
35reference = "https://attack.mitre.org/techniques/T1003/001/"
36
37
38
39[rule.threat.tactic]
40id = "TA0006"
41name = "Credential Access"
42reference = "https://attack.mitre.org/tactics/TA0006/"