LoFP LoFP / mimikatz can be useful for testing the security of networks

Techniques

Sample rules

Potential Invoke-Mimikatz PowerShell Script

Description

Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

Detection logic

condition: 1 of selection*
selection_1:
  ScriptBlockText|contains|all:
  - DumpCreds
  - DumpCerts
selection_2:
  ScriptBlockText|contains: sekurlsa::logonpasswords
selection_3:
  ScriptBlockText|contains|all:
  - crypto::certificates
  - CERT_SYSTEM_STORE_LOCAL_MACHINE