Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is

Hunt Hypothesis

This hunt hypothesis targets adversaries executing Powerkatz within PowerShell to perform in-memory credential theft and lateral movement while evading traditional file-based disk artifacts. Proactively hunting for this behavior in Azure Sentinel is essential because its memory-resident nature allows attackers to bypass standard endpoint detection, necessitating real-time identification of suspicious PowerShell command patterns to prevent rapid compromise escalation.

YARA Rule

rule Powerkatz_DLL_Generic {
	meta:
		description = "Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)"
		author = "Florian Roth"
		reference = "PowerKatz Analysis"
		date = "2016-02-05"
		super_rule = 1
		score = 80
		hash1 = "c20f30326fcebad25446cf2e267c341ac34664efad5c50ff07f0738ae2390eae"
		hash2 = "1e67476281c1ec1cf40e17d7fc28a3ab3250b474ef41cb10a72130990f0be6a0"
		hash3 = "49e7bac7e0db87bf3f0185e9cf51f2539dbc11384fefced465230c4e5bce0872"
	strings:
		$s1 = "%3u - Directory '%s' (*.kirbi)" fullword wide
		$s2 = "%*s  pPublicKey         : " fullword wide
		$s3 = "ad_hoc_network_formed" fullword wide
		$s4 = "<3 eo.oe ~ ANSSI E>" fullword wide
		$s5 = "\\*.kirbi" fullword wide

		$c1 = "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide
		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• PowerKatz Analysis
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Powerkatz detection rule, including suggested filters and exclusions:

• Automated Credential Rotation via PowerShell Scripts

  • Scenario: Enterprise Identity Management systems (e.g., Microsoft Entra ID Connect or custom internal scripts) frequently execute Invoke-Mimikatz or load Powerkatz modules to rotate service account passwords or extract Kerberos tickets during off-hours. These legitimate administrative tasks often trigger the rule due to the in-memory loading of the Mimikatz DLLs within a standard PowerShell process (powershell.exe).
  • Filter/Exclusion: Create an exclusion for powershell.exe processes where the parent process is a known service (e.g., svchost.exe, TaskScheduler) or specifically named scheduled tasks containing keywords like “PasswordRotation,” “IdentitySync,” or “CredentialUpdate.”

• Endpoint Detection and Response (EDR) Health Checks

  • Scenario: Security tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black often run internal diagnostic scripts that load Mimikatz libraries to verify the integrity of local security tokens or simulate attack scenarios. These health checks are scheduled daily or weekly and execute Powerkatz in memory without user interaction.
  • Filter/Exclusion: Exclude events where the CommandLine contains references to specific EDR vendor paths (e.g., \Program Files\CrowdStrike\, \Windows Defender\MpCmdRun.exe) or where the process hash matches a known, whitelisted version of the Powerkatz script used by the security team.

• ITSM and Configuration Management Tool Deployments

  • Scenario: Configuration management platforms like Ansible Tower, Puppet Agent, or SCCM (System Center Configuration Manager) utilize PowerShell to push configuration updates. During these deployments, they may invoke Powerkatz to validate domain controller connectivity or