HackTool - Mimikatz Kirbi File Creation

Title: HackTool - Mimikatz Kirbi File Creation
Status: test
Description:Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
References:
  -https://cobalt.io/blog/kerberoast-attack-techniques
  -https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
Author: Florian Roth (Nextron Systems), David ANDRE
Date: 2021-11-08
modified:2024-06-27
Tags:

• -'attack.credential-access'
• -'attack.t1558'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    TargetFilename|endswith:
      -'.kirbi'
      -'mimilsa.log'

  condition:selection
Falsepositives:
  -Unlikely
Level: critical