4

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. These signatures for mimikatz are included in the ET ATTACK RESPONSE class. This is great but not optimal because the usage has to cross over the "internet" or "datacenter" taps to become visible to an analyst and even then relies on the quality and granularity of the signatures written. So I'm interested in pursuing options or ideas to detect mimikatz at the host level. I have the ability to pull attributes from many many hosts at once with some home grown threading and Python. I just need to know what to look for? Does mimikatz leave any breadcrumbs? Or better yet is there something targetable like a process name or executable path that will be consistent on different platform usage? I'm hunting mimikatz in a Windows environment- the only thing I have found that is interesting is the concept of honey credentials injected into the LSASS- BUT this would need to be a startup script that had admin rights and I do not want admin creds on endpoints. (The injecting creds are fake, but to hit LSASS you must be an admin on the local machine.) there has to be other means of detecting mimikatz in near real time right?

5

SANS first ran an article on the basics of what you are looking for -- a way to detect mimikatz on the network -- https://isc.sans.edu/diary/Detecting+Mimikatz+Use+On+Your+Network/19311/

However, remember that mimikatz is capable of Kerberos attacks -- https://dfir-blog.com/2015/12/13/protecting-windows-networks-kerberos-attacks/ -- as well as PtH attacks -- https://dfir-blog.com/2015/11/08/protecting-windows-networks-defeating-pass-the-hash/

More on the theory behind the Kereberos attacks is available from Microsoft, including their recommendations for detection -- https://www.blackhat.com/docs/eu-15/materials/eu-15-Beery-Watching-The-Watchdog-Protecting-Kerberos-Authentication-With-Network-Monitoring.pdf

This site also had some interesting log analysis techniques that I had not seen before -- http://securitynik.blogspot.com/2016/03/learning-about-mimikatz-skeletonkey_96.html

Finally, a good defense will also include some mitigation and prevention -- https://jimshaver.net/2016/02/14/defending-against-mimikatz/ -- however, remember that mimikatz has been rewritten in GoLang and Powershell, so your mileage may vary when trying to prevent a well-informed attacker.

  • These are some very good resources to get this ball rolling. Thanks so much! I'll post back with detection methodology I decide to try and script! – Charles Apr 23 '16 at 16:51
  • I'll add that the SANS article I have read and others cover LSASS injection and "account" audits for said injection. Then when cache is dumped on reboot, we have to recreate the wheel- most likely via startup...this isn't the most viable option for me. But if it the best detection result I can look more. I'm trying to understand all possibilities and choose the option that is minimum viable enough for a single person to script(me) AND provide adequate detection against basic usage. – Charles Apr 23 '16 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.