Tag
high
advisory
Mimikatz MemSSP Log File Detection
2 rules 1 TTP 1 IOCThis rule detects the creation of the default Mimikatz MemSSP credential log file, mimilsa.log, which is created after the misc::memssp module injects a malicious Security Support Provider into LSASS, potentially capturing credentials from subsequent logons.
Elastic Defend +3
credential-access
mimikatz
memssp
windows
2r
1t
1i
high
advisory
Detects Kirbi File Creation
2 rules 1 TTPDetects the creation of .kirbi files, a suspicious Kerberos ticket artifact often produced by ticket export or dumping tools such as Rubeus or Mimikatz, indicating preparation for Kerberos ticket theft or Pass-The-Ticket (PTT) attacks.
Microsoft Defender XDR +2
credential-access
kerberos
pass-the-ticket
mimikatz
rubeus
2r
1t
critical
advisory
Potential Invoke-Mimikatz PowerShell Script
2 rules 1 TTPThis rule detects the use of Invoke-Mimikatz or Mimikatz commands within PowerShell scripts to dump credentials, extract password stores, export certificates, or use alternate authentication material, indicating potential in-memory credential access.
winlogbeat-*
credential-access
mimikatz
powershell
2r
1t