S0002 Mimikatz

toolEnterprise

PlattformenWindows

auch bekannt alsMimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks.

genutzte Techniken (17)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

T1003.001LSASS Memory
T1003.002Security Account Manager
T1003.004LSA Secrets
T1003.006DCSync
T1098Account Manipulation
T1134.005SID-History Injection
T1207Rogue Domain Controller
T1547.005Security Support Provider
T1550.002Pass the Hash
T1550.003Pass the Ticket
T1552.004Private Keys
T1555Credentials from Password Stores
T1555.003Credentials from Web Browsers
T1555.004Windows Credential Manager
T1558.001Golden Ticket
T1558.002Silver Ticket
T1649Steal or Forge Authentication Certificates

genutzt von Gruppen (51)

Zugehörige Bedrohungsgruppen.

genutzt von Kampagnen (9)

Kampagnen, die dies verwenden.

C0017C0017
C0018C0018
C0032C0032
C0038HomeLand Justice
C0061Operation Digital Eye
C0014Operation Wocao
C0058SharePoint ToolShell Exploitation
C0024SolarWinds Compromise
C0030Triton Safety Instrumented System Attack

Erkannt durch (Sigma) (12)

Zugehörige Sigma-Erkennungsregeln.

e5b33f7d-eb93-48b6-9851-09e1e610b6d7Credential Dumping Attempt Via WerFaulthigh
d0d2f720-d14f-448d-8242-51ff396a334eHackTool - Generic Process Accesshigh
4be8b654-0c01-4c9d-a10c-6b28467fc651LSASS Access From Potentially White-Listed Processeshigh
fa34b441-961a-42fa-a100-ecc28c886725LSASS Access From Program In Potentially Suspicious Foldermedium
9bd012ee-0dff-44d7-84a0-aa698cfd87a3LSASS Memory Access by Tool With Dump Keyword In Namehigh
06d71506-7beb-4f22-8888-e2e5e2ca7fd8Mimikatz Usehigh
5ef9853e-4d0e-4a70-846f-a9ca37d876daPotential Credential Dumping Activity Via LSASSmedium
a18dd26b-6450-46de-8c91-9659150cf088Potentially Suspicious GrantedAccess Flags On LSASSmedium
aa35a627-33fb-4d04-a165-d33b4afca3e8Remote LSASS Process Access Through Windows Remote Managementhigh
192a0330-c20b-4356-90b6-7b7049ae0b87Successful Overpass the Hash Attempthigh
611eab06-a145-4dfa-a295-3ccc5c20f59aSuspicious Machine Account Replication - DcSync Indicatormedium
678dfc63-fefb-47a5-a04c-26bcf8cc9f65Uncommon GrantedAccess Flags On LSASSmedium

Quelle

Wo diese Definition veröffentlicht ist.

auf ATT&CK ansehen

scry

Software wie diese trägt bekannte Schwachstellen, sobald sie im Internet exponiert ist. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan