Create MALW_kirbi_mimikatz

a4cb96d3 · Marc Rivero López · GitHub · b050f7de · a4cb96d3
Commit a4cb96d3 authored Aug 16, 2016 by Marc Rivero López Committed by GitHub Aug 16, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 13 additions and 0 deletions

MALW_kirbi_mimikatz malware/MALW_kirbi_mimikatz +13 -0

No files found.
--- a/malware/MALW_kirbi_mimikatz
+++ b/malware/MALW_kirbi_mimikatz
+rule mimikatz_kirbi_ticket
+{
+	meta:
+		description		= "KiRBi ticket for mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi); Didier Stevens"
+
+	strings:
+		$asn1			= { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
+		$asn1_84		= { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }
+
+	condition:
+		$asn1 at 0 or $asn1_84 at 0
+}