YARA · Samir Bousseaden (YaraHunts)
SBOUSSEADEN_Mimikatz_Memssp_Hookfn
hunt for default mimikatz memssp module both ondisk and in memory artifacts
- Author
- SBousseaden
- Date
- 2020-08-26
- Score / Quality
- 75 / 75
What this rule detects
hunt for default mimikatz memssp module both ondisk and in memory artifacts
Associated malware family: Mimikatz.
It defines 14 patterns (0 text, 14 hex, 0 regex).
YARA-X says: warning[duplicate_pattern_value]: duplicate pattern value
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Samir Bousseaden (YaraHunts), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: SBousseaden
Source repository: Samir Bousseaden (YaraHunts) @ 71b27a2a7c
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 845827b1-acd4-53af-97fb-43a4fe355fbf
Related rules
- SBOUSSEADEN_Mimikatz_KiwikeyMetadata onlyHack toolSamir Bousseaden (YaraHunts)· SBousseaden· 2020-08-08
- Hack toolSignature Base (Florian Roth / Nextron)· SBousseaden· 2020-08-26
- Hack toolSignature Base (Florian Roth / Nextron)· Benjamin DELPY (gentilkiwi)· 2022-11-16
- Hack toolSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-08-09
- Hack toolSEKOIA.IO Community· Sekoia.io· 2022-07-22
- Hack toolMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- Suspicious / huntingditekSHen detection· ditekSHen· 2020-11-06
- SBOUSSEADEN_Adsync_Creddump_V64Metadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08