Update: Since this post is getting some international attention I want to use the chance: If you are into Threat Hunting and interested in collaboration: Contact me and consider working on the ThreatHunter-Playbook! :) /Update

The art of hunting mimikatz with sysmons EventID 10 got already published by @cyb3rward0g in his great blog: Chronicles of a Threat Hunter: Hunting for In-Memory Mimikatz with Sysmon and ELK - Part II (Event ID 10). He also published the ThreatHunter Playbook which is a great collection of Windows Events you can use to hunt intruders in your network. I will shortly set up a GitHub Pull request to the playbook, maybe my findings are interesting for the community. :)

From there I today invested some time to analyze mimikatz to extract all uses of OpenProcess() and therefore some more indicators to hunt mimikatz. To achive that I first created a caller graph for OpenProcess() using the whole mimikatz source tree:

Update: I used mimikatz 2.1.1, which i checked out and build on April, 1st 2017. /Update

From there on I walked through the callers of OpenProcess() and extracted the following values (bitmask, opened process, module and command). To ease my work a little bit I wrote a small helper binary calc_mask which simply calculates the bitmask to the corresponding string:

$ ./calc_mask -m "PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION |
PROCESS_QUERY_INFORMATION"
0x1438

It's written in go, it is free but not yet complete. Get it here

From there on it was just some routine piece of work. Please note the comments in the last column.

• My most interesting finding is the behaviour of mimikatzs command event::drop, which patches the Eventlog process to drop all received events - even the event which is necessary to patch the Eventlog process (!). This might be some kind of race condition ...

• The Events, especially the amount, generated by the token::* commands is also noteworthy. These commands result in a huge number of OpenProcess() calls which should be pretty easy to monitor - see the comment column.

Todos:

• OpenProcessToken()
• ...

In the future I might post some elaboration about my findings, but for now: to the data...