Catching Mimikatz’ behavior with anomaly detection

Max Heinemeyer, Director of Threat Hunting | Friday February 15, 2019

Originally created by famed French programmer Benjamin Delpy to highlight security flaws in Windows authentication mechanisms, today Mimikatz is a staple post-exploitation module in the arsenal of cyber-criminals, since it facilitates lateral movement across a victim’s network. Mimikatz was a primary feature of the global ransomware attacks NotPetya and BadRabbit, in addition to the alleged Russian hacking of the German parliament in 2015 and 2017.

Among the primary vulnerabilities that Mimikatz exploits is Windows’ Local Security Authority Subsystem Service (LSASS), which is designed to obviate the need for users to reauthenticate every time they seek to access internal resources. Despite its clear utility, LSASS works by keeping a cache of every credential used since the last boot, presenting an obvious security risk in the event the cache is compromised. Broadly speaking, Mimikatz plunders this resource and allows users to access cleartext passwords as well as NTLM hashes. With this data in hand, threat actors are able to conduct the following attacks:

  • Kerberos Golden Ticket: Provides administrative credentials for the whole domain.
  • Pass-the-Ticket: Enables a user to pass a Kerberos ticket to a second device and login using this ticket.
  • Kerberos Silver Ticket: Provides a TGS ticket to log into any network service.
  • Pass-the-Hash: Allows a user to pass a hash string in order to login.

Dumping LSASS memory is just one method that Mimikatz and its many updated versions employ to harvest credentials. Indeed, once malware such as NotPetya has established itself on single device, the Mimikatz module can exploit a variety of security flaws to obtain the password information for any other users or computers that have logged onto that machine: a key step for both lateral movement and privilege escalation. Like many successful hacker tools, Mimikatz has inspired the creation of other programs with similar aims, which are largely intended to circumvent antivirus controls.

Using AI to end the cat-and-mouse game

At the most basic level, security teams can reduce vulnerability to Mimikatz and to lateral movement more generally by ensuring that each user has the minimum amount of privileges needed for his or her role. But while this measure is certainly prudent, it will not always be effective — especially when dealing with sophisticated threats. Another strategy is to implement endpoint security tools and anti-virus software, which rely on rules and signatures to detect known Mimikatz variants. However, as Mimikatz and its copycats continue to evolve, these traditional tools are locked in a ceaseless cat-and-mouse game, unable to spot unknown variants of Mimikatz that are designed to circumvent them.

As a fundamentally different approach to security, artificially intelligent systems like Darktrace avoid this cat-and-mouse game by learning what constitutes normal behavior for the users and devices they safeguard while “on the job,” rather than using fixed rules and signatures. This approach alerts defenders to any anomalous activity, regardless of whether such activity constitutes a known or unknown threat. Typically, lateral movement involving Mimikatz will involve a spike in unusual SMB activity, as attackers seek to write the tool to target devices. The following recent attack on a Darktrace customer highlights how AI can allow security teams to quickly detect and respond to such lateral movement involving Mimikatz:

  1. Darktrace alerts to a non-domain joined Linux device appearing on the customer’s network and engaging in extensive SMB bruteforce activity against key servers.

    Figure 1: Darktrace detects the spike in SMB activity.

  2. Darktrace flags the device successfully logging into a server using administrative credentials via SMBv1, opening the \sect pipe and writing the suspicious and likely malicious file Syssvc.exe to the server’s \temp folder. Immediately after this, Darktrace alerts to the device writing mimikatz.exe to the same folder.

    Figure 2: Darktrace flags the device using Mimikatz.

  3. Following this step, multiple .tmp and .txt files appear on the target device, indicating that Mimikatz was proceeding to access passwords and hashes.

The novelty of this AI-powered approach is that it does not rely on a string search for the term “mimikatz.exe”; rather, it highlights the unusual behavior that commonly surrounds Mimikatz’ activity. As shown in the screenshot above, this behavior constitutes “New activity”: Darktrace has not seen this type of SMB activity between the source and the destination before. Moreover, SMBv1 is used — highly unusual for the environment. And finally, it is unusual for devices in the target environment to make SMB network drive writes to Temp folders. All these subtle deviations from the customer’s ‘pattern of life,’ taken together, caused Darktrace to alert on the Mimikatz behavior.

Since its introduction to the cyber-threat landscape, Mimikatz has become a highly effective means for cyber-attackers to move laterally inside corporate and government networks. But by empowering security teams to respond before attackers can plunder a network’s entire cache of passwords, AI cyber defenses are thwarting Mimikatz and its copycats alike.

About the authors

Justin Fier

Justin Fier is the Director for Cyber Intelligence & Analytics at Darktrace, based in Washington D.C. Justin is one of the US’s leading cyber intelligence experts, and his insights have been widely reported in leading media outlets, including Wall Street Journal, CNN, the Washington Post, and VICELAND. With over 10 years of experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Dave Palmer

Dave Palmer is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over ten years of experience at the forefront of government intelligence operations, Palmer has worked across UK intelligence agencies GCHQ & MI5, where he delivered mission-critical infrastructure services, including the replacement and security of entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.

Andrew Tsonchev

Andrew advises Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning and autonomous response. He has a technical background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. He was most recently featured on BBC World, BBC Morning and Al Jazeera to comment on the news regarding the GRU.

Max Heinemeyer

Max is a cyber security expert with over eight years’ experience in the field specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. He was a member of the German Chaos Computer Club, working as a white hat hacker in penetration testing and red teaming engagements. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.