[metadata]
creation_date = "2020/12/07"
maturity = "development"
updated_date = "2020/12/07"

[rule]
author = ["Elastic"]
description = """
Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many
other features that make it useful for testing the security of networks. This rule detects the Invoke-Mimikatz
PowerShell command.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License"
name = "Mimikatz Powershell Module Activity Detected"
note = "This rule identifies an adversary attempt to collect, decrypt, and/or use cached credentials. Alerts from this rule should be prioritized because an adversary has an initial foothold onto an endpoint."
references = ["https://attack.mitre.org/software/S0002/"]
risk_score = 99
rule_id = "ac96ceb8-4399-4191-af1d-4feeac1f1f46"
severity = "critical"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Credential Access"]
type = "eql"

query = '''
process where event.type in ("start", "process_started") and process.name in ("cmd.exe", "powershell.exe")
and process.args : ("*DumpCreds", "*Mimikatz*")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

