cscli scenarios install sigmahq/proc_creation_win_hktl_mimikatz_command_line1type: trigger2name: sigmahq/proc_creation_win_hktl_mimikatz_command_line3description: |4 Detection well-known mimikatz command line arguments5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains 'DumpCreds' || evt.Parsed.CommandLine contains 'mimikatz' || evt.Parsed.CommandLine contains '::aadcookie' || evt.Parsed.CommandLine contains '::detours' || evt.Parsed.CommandLine contains '::memssp' || evt.Parsed.CommandLine contains '::mflt' || evt.Parsed.CommandLine contains '::ncroutemon' || evt.Parsed.CommandLine contains '::ngcsign' || evt.Parsed.CommandLine contains '::printnightmare' || evt.Parsed.CommandLine contains '::skeleton' || evt.Parsed.CommandLine contains '::preshutdown' || evt.Parsed.CommandLine contains '::mstsc' || evt.Parsed.CommandLine contains '::multirdp' || evt.Parsed.CommandLine contains 'rpc::' || evt.Parsed.CommandLine contains 'token::' || evt.Parsed.CommandLine contains 'crypto::' || evt.Parsed.CommandLine contains 'dpapi::' || evt.Parsed.CommandLine contains 'sekurlsa::' || evt.Parsed.CommandLine contains 'kerberos::' || evt.Parsed.CommandLine contains 'lsadump::' || evt.Parsed.CommandLine contains 'privilege::' || evt.Parsed.CommandLine contains 'process::' || evt.Parsed.CommandLine contains 'vault::')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1003.00115 - attack.t1003.00216 - attack.t1003.00417 - attack.t1003.00518 - attack.t1003.0061920 label: "HackTool - Mimikatz Execution"21 behavior : "windows:audit"22 remediation: false2324scope:25 type: ParentProcessId26 expression: evt.Parsed.ParentProcessId2728