Permalink
Cannot retrieve contributors at this time
Name already in use
A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
mimikatz/kiwi_passwords.yar
Go to fileThis commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
104 lines (80 sloc)
2.77 KB
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* Benjamin DELPY `gentilkiwi` | |
https://blog.gentilkiwi.com | |
benjamin@gentilkiwi.com | |
Licence : https://creativecommons.org/licenses/by/4.0/ | |
*/ | |
rule mimikatz | |
{ | |
meta: | |
description = "mimikatz" | |
author = "Benjamin DELPY (gentilkiwi)" | |
tool_author = "Benjamin DELPY (gentilkiwi)" | |
strings: | |
$exe_x86_1 = { 89 71 04 89 [0-3] 30 8d 04 bd } | |
$exe_x86_2 = { 8b 4d e? 8b 45 f4 89 75 e? 89 01 85 ff 74 } | |
$exe_x64_1 = { 33 ff 4? 89 37 4? 8b f3 45 85 c? 74} | |
$exe_x64_2 = { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 } | |
$dll_1 = { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 } | |
$dll_2 = { c7 0? 10 02 00 00 ?? 89 4? } | |
$sys_x86 = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 } | |
$sys_x64 = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 } | |
condition: | |
(all of ($exe_x86_*)) or (all of ($exe_x64_*)) or (all of ($dll_*)) or (any of ($sys_*)) | |
} | |
rule mimikatz_lsass_mdmp | |
{ | |
meta: | |
description = "LSASS minidump file for mimikatz" | |
author = "Benjamin DELPY (gentilkiwi)" | |
strings: | |
$lsass = "System32\\lsass.exe" wide nocase | |
condition: | |
(uint32(0) == 0x504d444d) and $lsass | |
} | |
rule mimikatz_kirbi_ticket | |
{ | |
meta: | |
description = "KiRBi ticket for mimikatz" | |
author = "Benjamin DELPY (gentilkiwi)" | |
strings: | |
$asn1 = { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 } | |
condition: | |
$asn1 at 0 | |
} | |
rule wce | |
{ | |
meta: | |
description = "wce" | |
author = "Benjamin DELPY (gentilkiwi)" | |
tool_author = "Hernan Ochoa (hernano)" | |
strings: | |
$hex_legacy = { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 } | |
$hex_x86 = { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 } | |
$hex_x64 = { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 } | |
condition: | |
any of them | |
} | |
rule lsadump | |
{ | |
meta: | |
description = "LSA dump programe (bootkey/syskey) - pwdump and others" | |
author = "Benjamin DELPY (gentilkiwi)" | |
strings: | |
$str_sam_inc = "\\Domains\\Account" ascii nocase | |
$str_sam_exc = "\\Domains\\Account\\Users\\Names\\" ascii nocase | |
$hex_api_call = {(41 b8 | 68) 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 } | |
$str_msv_lsa = { 4c 53 41 53 52 56 2e 44 4c 4c 00 [0-32] 6d 73 76 31 5f 30 2e 64 6c 6c 00 } | |
$hex_bkey = { 4b 53 53 4d [20-70] 05 00 01 00} | |
condition: | |
($str_sam_inc and not $str_sam_exc) or $hex_api_call or $str_msv_lsa or $hex_bkey | |
} | |
rule power_pe_injection | |
{ | |
meta: | |
description = "PowerShell with PE Reflective Injection" | |
author = "Benjamin DELPY (gentilkiwi)" | |
strings: | |
$str_loadlib = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9" | |
condition: | |
$str_loadlib | |
} |