rule win_mimikatz_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.mimikatz." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mimikatz" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 83f8ff 750e ff15???????? c7002a000000 } // n = 4, score = 300 // 83f8ff | cmp eax, -1 // 750e | jne 0x10 // ff15???????? | // c7002a000000 | mov dword ptr [eax], 0x2a $sequence_1 = { f7f1 85d2 7406 2bca } // n = 4, score = 300 // f7f1 | div ecx // 85d2 | test edx, edx // 7406 | je 8 // 2bca | sub ecx, edx $sequence_2 = { 83f812 72f1 33c0 c3 } // n = 4, score = 200 // 83f812 | cmp eax, 0x12 // 72f1 | jb 0xfffffff3 // 33c0 | xor eax, eax // c3 | ret $sequence_3 = { c3 81f998000000 7410 81f996000000 7408 81f99b000000 } // n = 6, score = 200 // c3 | ret // 81f998000000 | cmp ecx, 0x98 // 7410 | je 0x12 // 81f996000000 | cmp ecx, 0x96 // 7408 | je 0xa // 81f99b000000 | cmp ecx, 0x9b $sequence_4 = { f6c320 740f 83f809 7c05 } // n = 4, score = 200 // f6c320 | test bl, 0x20 // 740f | je 0x11 // 83f809 | cmp eax, 9 // 7c05 | jl 7 $sequence_5 = { f6c320 7413 6683f809 7206 } // n = 4, score = 200 // f6c320 | test bl, 0x20 // 7413 | je 0x15 // 6683f809 | cmp ax, 9 // 7206 | jb 8 $sequence_6 = { 66894108 33c0 39410c 740b } // n = 4, score = 200 // 66894108 | mov word ptr [ecx + 8], ax // 33c0 | xor eax, eax // 39410c | cmp dword ptr [ecx + 0xc], eax // 740b | je 0xd $sequence_7 = { 6683f83f 7607 32c0 e9???????? } // n = 4, score = 200 // 6683f83f | cmp ax, 0x3f // 7607 | jbe 9 // 32c0 | xor al, al // e9???????? | $sequence_8 = { e9???????? bd64000000 83ff2d 0f853c040000 c644245c01 } // n = 5, score = 200 // e9???????? | // bd64000000 | mov ebp, 0x64 // 83ff2d | cmp edi, 0x2d // 0f853c040000 | jne 0x442 // c644245c01 | mov byte ptr [esp + 0x5c], 1 $sequence_9 = { ff15???????? be00000400 8bc8 8bd6 } // n = 4, score = 200 // ff15???????? | // be00000400 | mov esi, 0x40000 // 8bc8 | mov ecx, eax // 8bd6 | mov edx, esi $sequence_10 = { ff5048 8bd8 85c0 7837 } // n = 4, score = 200 // ff5048 | call dword ptr [eax + 0x48] // 8bd8 | mov ebx, eax // 85c0 | test eax, eax // 7837 | js 0x39 $sequence_11 = { 2bc1 85c9 7403 83c008 } // n = 4, score = 200 // 2bc1 | sub eax, ecx // 85c9 | test ecx, ecx // 7403 | je 5 // 83c008 | add eax, 8 $sequence_12 = { 3c02 7207 e8???????? eb10 } // n = 4, score = 200 // 3c02 | cmp al, 2 // 7207 | jb 9 // e8???????? | // eb10 | jmp 0x12 $sequence_13 = { ff15???????? bd6f000000 3bc3 7405 } // n = 4, score = 200 // ff15???????? | // bd6f000000 | mov ebp, 0x6f // 3bc3 | cmp eax, ebx // 7405 | je 7 $sequence_14 = { 8d4d08 8d0437 51 50 e8???????? 83c40c } // n = 6, score = 100 // 8d4d08 | lea ecx, [ebp + 8] // 8d0437 | lea eax, [edi + esi] // 51 | push ecx // 50 | push eax // e8???????? | // 83c40c | add esp, 0xc $sequence_15 = { 33c9 3b04cd08d04600 7413 41 83f92d } // n = 5, score = 100 // 33c9 | xor ecx, ecx // 3b04cd08d04600 | cmp eax, dword ptr [ecx*8 + 0x46d008] // 7413 | je 0x15 // 41 | inc ecx // 83f92d | cmp ecx, 0x2d $sequence_16 = { 40 8945f4 83fb04 7561 33db 90 } // n = 6, score = 100 // 40 | inc eax // 8945f4 | mov dword ptr [ebp - 0xc], eax // 83fb04 | cmp ebx, 4 // 7561 | jne 0x63 // 33db | xor ebx, ebx // 90 | nop $sequence_17 = { e8???????? 8bc8 8b4508 ba???????? 2aca } // n = 5, score = 100 // e8???????? | // 8bc8 | mov ecx, eax // 8b4508 | mov eax, dword ptr [ebp + 8] // ba???????? | // 2aca | sub cl, dl $sequence_18 = { 8d04453cdb4600 8bc8 2bce 6a03 d1f9 68???????? } // n = 6, score = 100 // 8d04453cdb4600 | lea eax, [eax*2 + 0x46db3c] // 8bc8 | mov ecx, eax // 2bce | sub ecx, esi // 6a03 | push 3 // d1f9 | sar ecx, 1 // 68???????? | $sequence_19 = { 99 83ec0c 53 83e203 } // n = 4, score = 100 // 99 | cdq // 83ec0c | sub esp, 0xc // 53 | push ebx // 83e203 | and edx, 3 $sequence_20 = { c1e80d 8d4dd8 83e001 51 894614 c7461ce0164000 } // n = 6, score = 100 // c1e80d | shr eax, 0xd // 8d4dd8 | lea ecx, [ebp - 0x28] // 83e001 | and eax, 1 // 51 | push ecx // 894614 | mov dword ptr [esi + 0x14], eax // c7461ce0164000 | mov dword ptr [esi + 0x1c], 0x4016e0 $sequence_21 = { 8b5dd0 ebab c745e424714000 817de428714000 7311 8b45e4 8b00 } // n = 7, score = 100 // 8b5dd0 | mov ebx, dword ptr [ebp - 0x30] // ebab | jmp 0xffffffad // c745e424714000 | mov dword ptr [ebp - 0x1c], 0x407124 // 817de428714000 | cmp dword ptr [ebp - 0x1c], 0x407128 // 7311 | jae 0x13 // 8b45e4 | mov eax, dword ptr [ebp - 0x1c] // 8b00 | mov eax, dword ptr [eax] condition: 7 of them and filesize < 1642496 }