Mimikatz Memssp Module Log File Detection

The Mimikatz tool is frequently used by threat actors post-compromise to collect, decrypt, and utilize cached credentials to elevate privileges and facilitate lateral movement within a network. The misc::memssp module within Mimikatz injects a malicious Windows SSP (Security Support Provider) to collect locally authenticated credentials. This includes the computer account password, running service credentials, and credentials of any user logging onto the compromised system. This activity generates a log file named mimilsa.log by default. Detecting the creation of this file is a strong indicator of credential access and potential persistence activities on a Windows host. Defenders should prioritize investigating any instances of mimilsa.log creation to assess the scope of credential compromise.

Attack Chain

1. An attacker gains initial access to a Windows host, possibly through exploiting a vulnerability or through compromised credentials.
2. The attacker executes Mimikatz on the compromised host.
3. The attacker uses the misc::memssp module within Mimikatz.
4. Mimikatz injects a malicious SSP into the LSASS process (lsass.exe).
5. The injected SSP intercepts and logs locally authenticated credentials, including usernames, passwords, and hashes.
6. These credentials are saved to the mimilsa.log file in the same directory where Mimikatz was executed.
7. The attacker uses the captured credentials to elevate privileges or move laterally to other systems on the network.
8. The attacker achieves their final objective, such as data exfiltration, ransomware deployment, or system disruption, using the compromised credentials.

Impact

A successful Mimikatz attack leveraging the memssp module can result in widespread credential compromise, enabling attackers to gain unauthorized access to sensitive data and critical systems. This can lead to data breaches, financial loss, and significant reputational damage. If a domain controller is compromised, it could lead to complete Active Directory compromise. The severity depends on the privileges of the compromised accounts and the sensitivity of the accessed data.

Recommendation

• Deploy the Sigma rule "Mimikatz Memssp Log File Detected" to your SIEM to detect the creation of mimilsa.log on Windows endpoints.
• Enable Sysmon file creation logging to monitor for the creation of mimilsa.log, which is required for the Sigma rule to function effectively.
• If mimilsa.log is detected on a host, isolate the host and initiate incident response procedures, as outlined in the "Triage and analysis" section of the brief.
• Review and restrict privileges assigned to users with access to domain controllers to limit the potential impact of credential compromise.