kqlElastic-2.0from elastic/detection-rules

Potential Invoke-Mimikatz PowerShell Script

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1003 T1003.001 T1649 T1059 T1059.001

Rule sourcerules/windows/credential_access_mimikatz_powershell_module.toml

event.category:process and host.os.type:windows and
powershell.file.script_block_text:(
  (DumpCreds and
  DumpCerts) or
  "sekurlsa::logonpasswords" or
  ("crypto::certificates" and
  "CERT_SYSTEM_STORE_LOCAL_MACHINE")
)