Skip to content

Commit 41ea3b4

Browse files
rahul0216rahul0216
committed
Add Sigma rule workflows and new detection rules for Mimikatz-related activities
1 parent c93af4d commit 41ea3b4

9 files changed

Lines changed: 330 additions & 0 deletions

‎.github/workflows/sigma-tests.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# This workflow will install Python dependencies, run tests and lint with a single version of Python
2+
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
3+
4+
name: Sigma Rule Tests
5+
6+
on: [push, pull_request, merge_group, workflow_dispatch]
7+
8+
jobs:
9+
yamllint:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
13+
- name: yaml-lint
14+
uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3
15+
with:
16+
strict: true # fail on warnings as well
17+
18+
test-sigma-logsource:
19+
runs-on: ubuntu-latest
20+
needs: yamllint
21+
steps:
22+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23+
with:
24+
submodules: true
25+
- name: Set up Python 3.11
26+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
27+
with:
28+
python-version: 3.11
29+
- name: Test Sigma logsource
30+
run: |
31+
pip install PyYAML colorama
32+
python tests/test_logsource.py
33+
34+
test-sigma-legacy:
35+
runs-on: ubuntu-latest
36+
needs: yamllint
37+
steps:
38+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
39+
with:
40+
submodules: true
41+
- name: Set up Python 3.11
42+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
43+
with:
44+
python-version: 3.11
45+
- name: Test Sigma Rules
46+
run: |
47+
pip install PyYAML colorama
48+
python tests/test_rules.py
49+
50+
sigma-check:
51+
runs-on: ubuntu-latest
52+
needs: yamllint
53+
steps:
54+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
55+
with:
56+
submodules: true
57+
- name: Set up Python 3.11
58+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
59+
with:
60+
python-version: 3.11
61+
- name: Install dependencies
62+
run: |
63+
pip install pysigma
64+
pip install sigma-cli
65+
pip install pySigma-validators-sigmahq==0.21.*
66+
- name: Test Sigma Rule Syntax
67+
run: |
68+
sigma check --fail-on-error --fail-on-issues --validation-config tests/sigma_cli_conf.yml rules*
69+
70+
duplicate-id-check:
71+
runs-on: ubuntu-latest
72+
needs: yamllint
73+
steps:
74+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
75+
with:
76+
submodules: true
77+
- name: Check for duplicate IDs
78+
shell: /usr/bin/bash {0} # Use bash without -e to enable exit code manipulation
79+
run: |
80+
grep -rh "^id: " rules* deprecated unsupported | sort | uniq -c | grep -vE "^\s+1 id: "; exit $(( $? ^ 1 ))

‎.github/workflows/sigma-validation.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: Validate Sigma rules
2+
3+
on: [push, pull_request, merge_group, workflow_dispatch]
4+
5+
env:
6+
SIGMA_RULE_SCHEMA_VERSION: v2.1.0
7+
8+
jobs:
9+
sigma-rules-validator:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Validate Sigma rules
13+
uses: SigmaHQ/sigma-rules-validator@66a5abe3fb6d13ac203ded42045580845c9c5534 # v1
14+
with:
15+
paths: |-
16+
./*/sigma-rules
17+
schemaURL: https://raw.githubusercontent.com/SigmaHQ/sigma-specification/refs/tags/${{ env.SIGMA_RULE_SCHEMA_VERSION }}/json-schema/sigma-detection-rule-schema.json

‎mimikatz-tool/sigma-rules/lsa_authentication_package_change.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
title: LSA Authentication Package Registry Change
2+
id: 8e2336be-edde-4b27-b0fa-79f86f94802f
3+
status: experimental
4+
description: |
5+
Detects changes to LSA security, authentication, or notification package lists.
6+
Unexpected changes can support SSP credential interception or authentication
7+
process tampering, but approved authentication software uses these values too.
8+
references:
9+
- './Mimikatz-Threat-Research-and-Detection-Hypotheses.md'
10+
- 'https://attack.mitre.org/software/S0002/'
11+
author: Defender Content Team
12+
date: 2026-09-04
13+
tags:
14+
- attack.persistence
15+
- attack.credential-access
16+
- attack.t1547.005
17+
- attack.t1556
18+
logsource:
19+
category: registry_set
20+
product: windows
21+
definition: 'Requires registry value-set telemetry, such as Sysmon Event ID 13, for HKLM\SYSTEM\CurrentControlSet\Control\Lsa.'
22+
detection:
23+
selection_value:
24+
TargetObject|endswith:
25+
- '\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages'
26+
- '\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages'
27+
- '\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages'
28+
condition: selection_value
29+
falsepositives:
30+
- Approved authentication products, smart-card middleware, password filters, security software, or operating-system servicing
31+
level: high

‎mimikatz-tool/sigma-rules/lsa_protection_registry_change.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
title: LSA Protection Registry Value Changed
2+
id: 1f8432cb-fb82-442e-976f-f71d517473c3
3+
status: experimental
4+
description: |
5+
Detects modification of registry values that configure added LSA protection.
6+
The event can represent weakening or enabling protection; value semantics must
7+
be reviewed before treating the change as defense evasion.
8+
references:
9+
- './Mimikatz-Threat-Research-and-Detection-Hypotheses.md'
10+
- 'https://learn.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection'
11+
author: Defender Content Team
12+
date: 2026-09-04
13+
tags:
14+
- attack.defense-evasion
15+
- attack.t1562.001
16+
logsource:
17+
category: registry_set
18+
product: windows
19+
definition: 'Requires registry value-set telemetry, such as Sysmon Event ID 13, for the LSA configuration path.'
20+
detection:
21+
selection_value:
22+
TargetObject|endswith:
23+
- '\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL'
24+
- '\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPLBoot'
25+
condition: selection_value
26+
falsepositives:
27+
- Authorized security policy deployment, operating-system servicing, troubleshooting, or compatibility testing
28+
level: medium

‎mimikatz-tool/sigma-rules/mimikatz_names_or_commands.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
title: Mimikatz Names or Credential-Dumping Commands
2+
id: ed66cacc-48a8-4b72-a4a8-1ab090614363
3+
status: experimental
4+
description: |
5+
Detects documented Mimikatz-related executable names or credential-dumping
6+
command terms in process creation telemetry. This rule is intended as a
7+
high-context lead and does not cover renamed or modified implementations.
8+
references:
9+
- './Mimikatz-Threat-Research-and-Detection-Hypotheses.md'
10+
- 'https://github.com/gentilkiwi/mimikatz'
11+
- 'https://github.com/skelsec/pypykatz'
12+
author: Defender Content Team
13+
date: 2026-09-04
14+
tags:
15+
- attack.credential-access
16+
- attack.t1003
17+
logsource:
18+
category: process_creation
19+
product: windows
20+
definition: 'Requires process creation telemetry with Image and full CommandLine fields populated.'
21+
detection:
22+
selection_image:
23+
Image|endswith:
24+
- '\mimikatz.exe'
25+
- '\voStro.exe'
26+
selection_command:
27+
CommandLine|contains:
28+
- 'Invoke-Mimikatz'
29+
- 'sekurlsa::'
30+
- 'lsadump::'
31+
- 'pypykatz'
32+
condition: 1 of selection_*
33+
falsepositives:
34+
- Authorized security testing, malware analysis, or training activity
35+
- Detection engineering that executes representative command lines in an isolated lab
36+
level: high

‎mimikatz-tool/sigma-rules/mimikatz_powershell_content.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
title: Mimikatz-Related PowerShell Content
2+
id: 7424aa12-ca1e-4937-8c11-4ef90a6a085f
3+
status: experimental
4+
description: |
5+
Detects PowerShell script content containing documented Mimikatz invocation or
6+
credential-dumping command terms. This is string-based supporting coverage and
7+
can be bypassed by modified, encoded, or API-driven implementations.
8+
references:
9+
- './Mimikatz-Threat-Research-and-Detection-Hypotheses.md'
10+
- 'https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-Mimikatz.ps1'
11+
- 'https://github.com/gentilkiwi/mimikatz'
12+
author: Defender Content Team
13+
date: 2026-09-04
14+
tags:
15+
- attack.credential-access
16+
- attack.t1003
17+
logsource:
18+
category: ps_script
19+
product: windows
20+
definition: 'Requires PowerShell Script Block Logging event 4104 or equivalent telemetry with ScriptBlockText populated.'
21+
detection:
22+
selection_content:
23+
ScriptBlockText|contains:
24+
- 'Invoke-Mimikatz'
25+
- 'sekurlsa::'
26+
- 'lsadump::'
27+
- 'pypykatz'
28+
condition: selection_content
29+
falsepositives:
30+
- Authorized security testing, malware analysis, or training activity
31+
- Documentation or detection content processed as PowerShell script text
32+
level: high

‎mimikatz-tool/sigma-rules/script_host_access_to_lsass.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
title: Script Host Access to LSASS
2+
id: 15af367f-e617-4049-a0a4-0de757a8c44f
3+
status: experimental
4+
description: |
5+
Detects a Windows script host opening LSASS. This can indicate script-hosted or
6+
in-memory credential dumping, including capability-equivalent Mimikatz activity,
7+
but does not identify a specific tool by itself.
8+
references:
9+
- './Mimikatz-Threat-Research-and-Detection-Hypotheses.md'
10+
- 'https://attack.mitre.org/software/S0002/'
11+
- 'https://learn.microsoft.com/sysinternals/downloads/sysmon'
12+
author: Defender Content Team
13+
date: 2026-09-04
14+
tags:
15+
- attack.credential-access
16+
- attack.t1003.001
17+
logsource:
18+
category: process_access
19+
product: windows
20+
definition: 'Requires Sysmon Event ID 10 or equivalent process-access telemetry with SourceImage and TargetImage populated.'
21+
detection:
22+
selection_target:
23+
TargetImage|endswith: '\lsass.exe'
24+
selection_source:
25+
SourceImage|endswith:
26+
- '\powershell.exe'
27+
- '\powershell_ise.exe'
28+
- '\pwsh.exe'
29+
- '\wscript.exe'
30+
- '\cscript.exe'
31+
- '\mshta.exe'
32+
condition: selection_target and selection_source
33+
falsepositives:
34+
- Authorized security testing or administrative frameworks that intentionally inspect LSASS
35+
- Endpoint security or diagnostic tooling hosted by a listed script interpreter
36+
level: high

‎mimikatz-tool/sigma-rules/sensitive_registry_hive_export.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
title: Sensitive Registry Hive Export With Reg
2+
id: bbee7798-32f6-4960-aa9f-4b9d07d4cc2f
3+
status: experimental
4+
description: |
5+
Detects reg.exe exporting the SAM, SYSTEM, or SECURITY hive. Such exports can
6+
support offline local hash or LSA secret extraction, but each event alone does
7+
not prove that credential material was parsed or transferred.
8+
references:
9+
- './Mimikatz-Threat-Research-and-Detection-Hypotheses.md'
10+
- 'https://attack.mitre.org/software/S0002/'
11+
author: Defender Content Team
12+
date: 2026-09-04
13+
tags:
14+
- attack.credential-access
15+
- attack.t1003
16+
logsource:
17+
category: process_creation
18+
product: windows
19+
definition: 'Requires process creation telemetry with full command-line collection, such as Sysmon Event ID 1 or Security Event ID 4688 with command lines enabled.'
20+
detection:
21+
selection_image:
22+
Image|endswith: '\reg.exe'
23+
selection_action:
24+
CommandLine|contains: ' save '
25+
selection_hive:
26+
CommandLine|contains:
27+
- 'hklm\sam'
28+
- 'hklm\system'
29+
- 'hklm\security'
30+
- 'hkey_local_machine\sam'
31+
- 'hkey_local_machine\system'
32+
- 'hkey_local_machine\security'
33+
condition: selection_image and selection_action and selection_hive
34+
falsepositives:
35+
- Authorized backup, recovery, migration, forensic, or endpoint-management activity
36+
level: high

‎mimikatz-tool/sigma-rules/user_writable_dll_loaded_by_lsass.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
title: User-Writable DLL Loaded by LSASS
2+
id: 1b1ec66a-67ca-4d0b-aca5-42a86f876edc
3+
status: experimental
4+
description: |
5+
Detects LSASS loading a DLL from a user-writable or temporary path. This can
6+
indicate an unexpected authentication package or in-memory authentication
7+
tampering, but does not specifically identify Mimikatz or Skeleton Key.
8+
references:
9+
- './Mimikatz-Threat-Research-and-Detection-Hypotheses.md'
10+
- 'https://learn.microsoft.com/sysinternals/downloads/sysmon'
11+
- 'https://www.sophos.com/en-us/research/skeleton-key-malware-analysis'
12+
author: Defender Content Team
13+
date: 2026-09-04
14+
tags:
15+
- attack.credential-access
16+
- attack.defense-evasion
17+
- attack.t1556
18+
logsource:
19+
category: image_load
20+
product: windows
21+
definition: 'Requires image-load telemetry, such as Sysmon Event ID 7, configured to record modules loaded by lsass.exe.'
22+
detection:
23+
selection_process:
24+
Image|endswith: '\lsass.exe'
25+
selection_path:
26+
ImageLoaded|contains:
27+
- '\Users\'
28+
- '\ProgramData\'
29+
- '\Windows\Temp\'
30+
condition: selection_process and selection_path
31+
falsepositives:
32+
- Approved authentication, identity, or endpoint-security software installed from a listed path
33+
- Authorized security testing or support activity
34+
level: high

0 commit comments

Comments
 (0)