Detection: Detect Mimikatz Using Loaded Images

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: Detection deprecated as it no longer effectively identifies the intended malicious activity

Removed in version: 5.2.0

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 Author: Patrick Bareiss, Splunk Type: TTP Product: Splunk Enterprise Security

Description

This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code.

Search

1`sysmon` EventCode=7 ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll 
2| fillnull 
3| stats count min(_time) as firstTime max(_time) as lastTime by EventID FileVersion Guid Hashes Image ImageLoaded MD5 Opcode OriginalFileName ProcessGuid ProcessID ProcessId SHA256 SecurityID Signature SignatureStatus Signed UserID dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product 
4| `security_content_ctime(firstTime)`
5| `security_content_ctime(lastTime)` 
6| `detect_mimikatz_using_loaded_images_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 7	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
sysmon	`(source=WinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational)`
detect_mimikatz_using_loaded_images_filter	``

detect_mimikatz_using_loaded_images_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1003.001	LSASS Memory	Credential Access

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.

Known False Positives

Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process.

Associated Analytic Story

References

https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 5