Mimikatz .kirbi File Creation (RedCanary Threat Detection Report)

 1title: Mimikatz .kirbi File Creation (RedCanary Threat Detection Report)
 2id: 3f5c1eae-a9ef-44a2-bd04-a8a0e3762ec3
 3status: experimental
 4description: Detects .kirbi files created, commonly associated with Mimikatz. Part of the RedCanary 2023 Threat Detection Report.
 5references:
 6    - https://redcanary.com/threat-detection-report/threats/mimikatz/
 7author: RedCanary, Sigma formatting by Micah Babinski
 8date: 2023/05/10
 9tags:
10    - attack.s0002
11logsource:
12    category: file_event
13    product: windows
14detection:
15    selection:
16        TargetFilename|endswith: '.kirbi'
17    condition: selection
18falsepositives:
19    - Unknown
20level: low```

References

• Mimikatz - Red Canary Threat Detection Report

  

  Mimikatz is a credential-dumping utility commonly leveraged by adversaries, penetration testers, and red teams to extract passwords.

  
  Read More

Related rules

• Mimikatz Module Names in Command Line (RedCanary Threat Detection Report)
• Mimikatz Use