Versions (4)
Version DetailsCurrent
Rev: 1 • Mar 19, 2025, 4:38 PMTGI HUNT MimiKatz String in HTTP Response x64 1
alert http any any -> any any (msg:"TGI HUNT MimiKatz String in HTTP Response x64 1"; flow:to_client,established; file_data; content:"|33 ff|"; content:"|89 37|"; within:3; content:"|8b f3 45 85|"; within:5; content:"|74|"; within:2; threshold:type limit,track by_src,seconds 60,count 1; reference:url,github.com/gentilkiwi/mimikatz/releases; classtype:bad-unknown; sid:2610408; rev:1;)
Mar 19, 2025, 4:38 PM
Mar 19, 2025, 4:38 PM
Jul 29, 2025, 5:35 PM
Jul 29, 2025, 5:35 PM
hunting.rules