Detecting Mimikatz Execution Patterns
FreeProactively identify Mimikatz credential dumping activities.
Free · Opens the source repo
What Detecting Mimikatz Execution Patterns does
Detecting Mimikatz Execution Patterns is a specialized skill designed for cybersecurity professionals engaged in threat hunting and incident response. This skill enables users to identify and analyze Mimikatz-related activities through command-line pattern matching, LSASS access signatures, and other indicators. By leveraging this skill, security teams can enhance their detection capabilities against credential dumping techniques, specifically those outlined in the MITRE ATT&CK framework under technique T1003. This is crucial for organizations aiming to safeguard their environments against sophisticated attacks.
The skill operates by integrating with existing EDR and SIEM platforms, requiring telemetry data from tools like CrowdStrike, Microsoft Defender, or Splunk. Users can formulate hypotheses based on threat intelligence or gap analyses and execute detection queries to gather relevant events. The workflow emphasizes a systematic approach, from hypothesis formulation to documentation of findings, ensuring that security teams can validate their detection mechanisms and respond effectively to potential threats.
This skill is particularly useful in scenarios where there is a heightened risk of credential theft, such as during active campaigns or when alerts are triggered by EDR/SIEM systems. It also serves as a valuable resource during purple team exercises, allowing teams to assess their detection coverage against known attack patterns. By providing a structured methodology for detecting Mimikatz execution patterns, this skill empowers security professionals to proactively hunt for threats and mitigate risks before they escalate into significant incidents.
Overall, Detecting Mimikatz Execution Patterns is an essential tool for organizations that prioritize proactive security measures and wish to enhance their capabilities in detecting credential dumping activities.
When to use it
Use this skill when hunting for Mimikatz execution patterns, especially after threat intelligence indicates active campaigns or during incident response.
When not to use it
This skill may not be suitable if your environment lacks the necessary EDR/SIEM integrations or if you're not focused on credential dumping threats.
What you can build with it
Active Threat Hunting
Utilize this skill to proactively search for Mimikatz execution patterns when threat intelligence indicates ongoing campaigns.
Incident Response Scoping
Employ the skill during incident response to identify and scope potential compromises related to credential dumping.
Security Assessments
Integrate this skill into periodic security assessments to validate detection mechanisms against known Mimikatz techniques.
How to install Detecting Mimikatz Execution Patterns
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-mimikatz-execution-patterns --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Mimikatz Execution Patterns
When to Use
- When proactively hunting for indicators of detecting mimikatz execution patterns in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1003.001 | LSASS Memory |
| T1003.006 | DCSync |
| T1558.003 | Kerberoasting |
| T1558.001 | Golden Ticket |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: Standard sekurlsa::logonpasswords credential dump
- Scenario 2: PowerShell Invoke-Mimikatz reflective loading
- Scenario 3: DCSync from non-DC host
- Scenario 4: Golden ticket creation for persistence
Output Format
Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1003.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Detecting Mimikatz Execution Patterns
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.