Potential Invoke-Mimikatz PowerShell Script

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects the execution of PowerShell scripts containing patterns commonly associated with Mimikatz, a tool used for dumping credentials. The rule looks for specific strings related to Mimikatz functionalities like 'DumpCreds', 'DumpCerts', 'sekurlsa::logonpasswords', and 'crypto::certificates' in conjunction with 'CERT_SYSTEM_STORE_LOCAL_MACHINE'.