Common Information
Type Value
Value
rule mi_mimikatz_11462 {
	meta:
		description = "Mimikatz - file mi.ps1"
		author = "The DFIR Report"
		reference = "https://thedfirreport.com"
		date = "2022-05-01"
		hash1 = "d00edf5b9a9a23d3f891afd51260b3356214655a73e1a361701cda161798ea0b"
	strings:
		$x1 = "$best64code = \"==gCNkydtdnbrpXbttmc01mazp2bkgCWFlkCNkSKoo3ZtNnatpHayBHJuMXb3RHanNne1FXarhGJo4Wa0R3b3Fnerl3a3RiLr5GcnBHcutmcnpGd"
		$s2 = "lFM5cmbFVFMatSYLlTdTN2QCdXZyg2QsJVYGFEZiJERBV3T0ZVaYJGZZx2Kx4GSXxGdll1LSJ2R5F2d5J3N3VjSRtUZzgDUmpFOap1TwI3bKpHVDFlNL9GUQJTdwYUUr"
		$s3 = "JFT0omerhFawNXbDVVcIdXZ1REOyMUVXBHVZpWZvUGN6dUMp9ycysCbtBXY5IUVSFVbiNXVtJUYVRFeD5mVYtEMIt0SiB3blZmTHlUWrUmV4RXdr80bw12QuVTQtx2LV"
		$s4 = "x0dGlHUFpUYhV1YXVjR4N1b3p0cVRTTj10TxRFNxhnVEdHd5lGWPNTNFdjexRkNzl2MPtie0RWcnJXQ3djbIN0didHMzJTM5NmS01GaB50Z2VGSJVFOyZGd5hlN1BDMR"
		$s5 = "R1TVhlRO10QXtiU4s2UrNEeXp1QDFzblRHb2UmZLFTdsJFR2BDcmdVesdnQKVWZ21GOQ5kaTdGTRJ1UXNzMVdDU4NHa0p0V3MDeEVFaExEcpBVQzQlY5g0bRV0N1lkQq"
		$s6 = "RUUERUNw5UdSZ3bpp0cVVmeRpVVMx2R1ETZIZzYGhEd6J3VidHT3IUMUhHasR3cwAnM2sST5pUZiNVcjFlcSR3cTJkcmdzKZhkTzNGWzJmZ5N1a6lGbZFXSvEzMFBzRa"
		$s7 = "lnMkxERH9EMiRmW4k2doBDS6dXdLlDM4VmRrlTWwMmSmFnNCV1YLdjN0sCUp9WST9SYHlkYaRWb5R3L0oVNn50am9EU6hkV0InYCNmWv4WTktUSxdnW0gET25GNxsWO4"
		$s8 = "NzTyIXSJdFMip1ZrNVY1VzQStCVatEdm92ZU1Wc09SYNt0LRBnYPlEchV1RJN3ZLBlVtRlM2FDNWR0RSZ3d30mUNpHWD52SQFTNQtiS2kEalx0dll3UzQ2NGVEVIl0YT"
		$s9 = "hzQ0QVYxhXWNdDN2lzd0JUR582TUhzaCJmVQhHaLp0c5VkWpNnQhh2QhJDO3oVSwczUkR0MyMkcwAldwJDbOd0SNJEVil0QVF3NGFkez5UYMZUQzgUM3gFOGhGRzU2Vw"
		$s10 = "5mMnVDcohGWUVmbjlDWHFmVv8SY3ZGTrdja3k2TOd3KMBlUstmWrNzYyQzKwIzKzknQYlzKrknYlJndTFleDdnWV5Uc04kNYRldll3LaJjckBTMVp0cPZlZ1Y0MpZkS1"
		$s11 = "F0KtlDetp0c4BnaBVXWERnczUWRPN2KDVTMkh1dFdFaKNmYKRGMrMHan5UbrRGMzIXcvlFe1J0Z0dUMPRFSvlndo9mSkpWQTV1SyNFZLFHRnVWRP5EcjJGcBp3L1c3am"
		$s12 = "QWb5Z0UhJFUwgETQdGMxATdUdXcXRHcTVTMrQEe6JEWBxUTVhGR1hGULp1Vx8UQLRncYBnaN9mVDBFazcnbRFTSJpXTuZDS4dTd0l0ZGJTUYlUSwIEcIFDcnF0Zip0cJ"
		$s13 = "RVUm9GcjV0MwQGV3NGWxMWVSRDMNJHevdUMpFHVxMXQyp3VrcHVJdGeJtUQvMXb3dUZ4cERUdHN3FFSQ5kdL9kap5ENmJ3TDVESHN0SCZlQXJDc2BDOIlmNxxUY0RkN2"
		$s14 = "FzUZxWejZWMmV2ZpdjTxg3arMnQCB1LvoXY4kVdkFEeM1GcwB3TDllMFZGeTF3Z4MzRSR2KTBFaz8EWzBlQlJ0ckNHTpd2KwkURpBXQWF1ZjRTRqlVNvImYmF0bmtUYV"
		$s15 = "NnW3oHNkZ3NY9mMTtmbNJTQx8WdNl3NCtCZGpVOMdUT2BzUWFTW5UjZu9CRIdHcLJzNoZTThhkVwgDOGdXM2B1dLlzUI9SQrllTqVkbst0TywmUwcXTPJmRvFFTPhEeh"
		$s16 = "JUbL5WZxMXQux2bMNFNHhkVh1mY59UQP50Kp52N2FHa1ZHexcXN1oHRMhkes9icpZXU0VTc050VGZDOidUMPZDW0NkNwNjWxVHNrUUVvJmQ4p1LY10ZyFHTBBXcIZ2aZ"
		$s17 = "FmN44kQz9yMRZTQKp1UmVFaOdnSSR3THdkSHJDdO5WRT90SSpHZjZVT3NUZwFkWWhlNpJzN04UZpRzLERnTtVGM4JTbyFGeTRXUwgHeyEmWTVlUr8kU4tyL2JnNTZENv"
		$s18 = "d0aZ1WOFp1YTRWZ4tUVrN0Q5AVQEV3a3UnV2U0QkR3L3hEU3o3LJFWQnZzdzEUO4hFbBJDTUJGeopkclNjMFJDZ6lHa4o1LUVGShp0cup3L5dWZxpmS11mcix2VV5ERv"
		$s19 = "9CNqJmSVRUZjFDR3B1VGhUNZNkQxNmS18WRwpHc2lUYBN1RYNXcntEZWNFeyEzMiRWQr8WOLRVZyg0QiF0QI1Gbr0mZvkmdyxUb4p3Kph2dadGb5EjSRFFdq9WSutydi"
		$s20 = "dUb2JDZLdVVvpFe2YVS1lzSvl1MnlGdv92KKZWdWZGahxUaipGWypUeEZ3dyZWONJFTUdjTx5GR4p0KwYXaSZ2dLl2cRxGS4ZWdZFTNvoEeQpWRKJWQahkaTZWcz9iNa"
	condition:
		uint16(0) == 0x6224 and filesize < 10000KB and 1 of ($x*) and 4 of them
}
Category
Type Yara Rule
Misp Type
Description
Details Published Attributes CTI Title
Details Website 2022-05-09 39 Yara-Rules/SEO Poisoning – A Gootloader Story at main · The-DFIR-Report/Yara-Rules