detecting-mimikatz-execution-patterns

Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

インストールへ移動

リポジトリ: xalgord/xalgorix
ソースの最終更新活動: 2026年6月6日 16:41
検出された SKILL.md の言語: 英語
スター: 813
フォーク: 146

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/xalgord/xalgorix --skill detecting-mimikatz-execution-patterns

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

このリポジトリのすべてを見る

Detecting Mimikatz Execution Patterns

When to Use

When proactively hunting for indicators of detecting mimikatz execution patterns in the environment

After threat intelligence indicates active campaigns using these techniques

During incident response to scope compromise related to these techniques

When EDR or SIEM alerts trigger on related indicators

During periodic security assessments and purple team exercises

Detection Gaps & Validation

String/hash signatures are trivially evaded. Renamed binaries, in-memory execution (Invoke-Mimikatz, reflective PE load, Cobalt Strike BOFs), and renamed module strings (sekurlsa::logonpasswords) defeat command-line and file-hash detection. Don't anchor on mimikatz keywords.

The durable signal is LSASS access. Hunt Sysmon EID 10 ProcessAccess targeting lsass.exe with GrantedAccess of 0x1010, 0x1410, 0x143a, or 0x1fffff from a non-system process. Verify EID 10 is enabled and lsass is not excluded in the Sysmon config — a common gap.

LOLBin dumping bypasses mimikatz entirely: rundll32 comsvcs.dll MiniDump <pid> ..., Task Manager "Create dump file", and procdump -ma lsass.exe produce a dump with no mimikatz artifacts. Hunt these command lines plus EID 11 writes of *.dmp.

Protection changes the picture: RunAsPPL and Credential Guard block classic reads (attackers may avoid lsass). The Microsoft-Windows-Threat-Intelligence ETW provider catches suspicious lsass handle opens that user-mode logging misses.

Validate the rule fires: run procdump -ma lsass.exe (or lab mimikatz sekurlsa::logonpasswords) and confirm both the EID 10 GrantedAccess query and the comsvcs/dmp query trigger.

Tune false positives: AV/EDR (e.g., MsMpEng), backup, and DLP agents legitimately open lsass. Allowlist signed security tools by image path rather than suppressing all lsass access.

Prerequisites

EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)

SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)

Sysmon deployed with comprehensive configuration

Windows Security Event Log forwarding enabled

Threat intelligence feeds for IOC correlation