title: Mimikatz MemSSP Default Log File Creation
id: 034affe8-6170-11ec-844f-0f78aa0c4d66
status: experimental
description: Detects Mimikatz MemSSP default log file creation
author: David ANDRE
references:
   - https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
date: 2021/12/20
tags:
   - attack.credential_access
   - attack.t1003
logsource:
    product: windows
    category: file_event
detection: 
   mimikatz_memssp_filename:
      TargetFilename|endswith:
         - 'mimilsa.log'
   condition: mimikatz_memssp_filename
falsepositives:
   - Unlikely
level: critical
