Detection of Mimikatz Credential Dumping via PowerShell

The Invoke-Mimikatz PowerShell script is a widely utilized post-exploitation tool designed to interact with the Windows Local Security Authority Subsystem Service (LSASS). By executing specialized memory-reading commands, the script enables attackers to extract plaintext credentials, Kerberos tickets, and digital certificates from memory. This technique is a cornerstone of credential access phases, allowing adversaries to escalate privileges or move laterally within a compromised network. Defenders should focus on Script Block Logging (Event ID 4104) to identify the execution of these specific function signatures and strings within the PowerShell runtime. While sometimes used by authorized penetration testers for security auditing, unauthorized execution of these commands is a strong indicator of an active credential theft attempt.

Attack Chain

1. Attacker establishes an initial foothold on a Windows endpoint.
2. Attacker loads a PowerShell environment to execute post-exploitation commands.
3. Attacker imports or streams the Invoke-Mimikatz script into memory to avoid disk-based detection.
4. Attacker executes specific memory manipulation commands such as 'sekurlsa::logonpasswords' or 'DumpCreds'.
5. The script interfaces with LSASS to bypass security controls and scrape memory segments.
6. Attacker exfiltrates the recovered credentials to an external command-and-control server.
7. Attacker utilizes the stolen credentials to impersonate legitimate users or escalate privileges.

Impact

Successful execution of Mimikatz allows an adversary to obtain plaintext passwords, NTLM hashes, and Kerberos tickets for users currently logged into the system. This level of access grants the attacker the ability to maintain persistence, impersonate high-privilege accounts (such as Domain Admins), and perform lateral movement, often leading to full domain compromise and significant data exfiltration.

Recommendation

1. Enable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to capture script execution content.
2. Deploy the provided Sigma rule to your SIEM to monitor for known Mimikatz command strings in PowerShell script blocks.
3. Alert on any detected instances of 'sekurlsa::logonpasswords' or certificate dump functions.
4. Conduct an immediate investigation if these commands are identified on high-value systems like domain controllers or workstations belonging to administrative personnel.