{"id":1871,"date":"2021-11-17T16:01:31","date_gmt":"2021-11-17T13:01:31","guid":{"rendered":"https:\/\/macrosec.tech\/?p=1871"},"modified":"2022-04-26T14:55:16","modified_gmt":"2022-04-26T11:55:16","slug":"using-elastalert-to-alert-via-email-when-mimikatz-is-run","status":"publish","type":"post","link":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/","title":{"rendered":"Using Elastalert to alert via email when Mimikatz is run."},"content":{"rendered":"

USING ELASTALERT TO ALERT VIA EMAIL WHEN MIMIKATZ IS RUN.<\/span><\/strong><\/h2>\n<\/div>
\"Haystack<\/span><\/div><\/div><\/div><\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/div>
<\/div>
<\/div>

This blog post was written by Dharmik Karania <\/a><\/p>\n<\/div>

<\/div>
<\/div><\/div>
<\/div>

Introduction<\/strong><\/h2>\n

In this blog, I shall discuss how an alert can be sent via email when Mimikatz is run.<\/p>\n

Mimikatz is a post-exploitation tool that is used to dump passwords from memory, along with hashes. This allows attackers to conduct various other attacks such as lateral movement more easily. When an attacker gains an initial foothold to a machine, they may run Mimikatz in order to retrieve passwords or passwords hashes. As blue teamers, it is crucial to setup mechanisms to detect attacks and take appropriate measures to safeguard information systems.<\/p>\n

Prerequisites:<\/strong><\/h2>\n
    \n
  1. ELK Setup<\/li>\n
  2. Configure winlogbeat on Windows Machine<\/li>\n<\/ol>\n

    Introduction to ELK<\/strong><\/h2>\n

    According to Elastic, “ELK” is the acronym for three open-source projects: Elasticsearch, Logstash, and Kibana. Elasticsearch is a search and analytics engine. Logstash is a server side data processing pipeline that ingests data from multiple sources simultaneously, transforms it, and then sends it to a “stash” like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch.<\/p>\n

    To setup ELK, you can either use the GitHub repository or setup manually. I have setup my stack manually. Once the ELK stack has been installed successfully, the next step is to install Elastalert.<\/p>\n

    To install and setup Elastalert, I shall run the following commands on the terminal window.<\/p>\n

    sudo apt-get install -y python<\/p>\n

    sudo apt-get install -y python-pip python-dev libffi-dev libssl-dev<\/p>\n

    git clone https:\/\/github.com\/Yelp\/elastalert.git<\/p>\n

    cd elastalert<\/p>\n

    sudo pip install “setuptools>=11.3”<\/p>\n

    sudo pip install pyOpenSSL<\/p>\n

    sudo python setup.py install<\/p>\n

    sudo pip install “elasticsearch>=5.0.0”<\/p>\n

    cp config.example.yaml config.yaml<\/p>\n

    The config.yaml file needs to be edited in order to update the es_host with the IP address of the elasticsearch server.<\/p>\n<\/div>

    <\/span><\/div><\/div>

    \u00a0<\/p>\n<\/div>

    The next step is to create the Elastalert index by typing the command:<\/p>\n

    elastalert-create-index<\/p>\n<\/div>

    <\/span><\/div><\/div>

    \u00a0<\/p>\n<\/div>

    Configuring Postfix Gmail SMTP.<\/strong><\/h2>\n

    To be able to receive alerts on Gmail, there are some configurations I will need to do on my ELK Server. First off, I will need to install Postfix and its dependencies by running the following command:<\/p>\n

    sudo apt-get install postfix mailutils libsasl2-2 ca-certificates libsasl2-modules<\/p>\n

    Once the installation is complete, we need to edit the main.cf file. The file is found at this location:<\/p>\n

    \/etc\/postfix\/main.cf<\/p>\n

    In the main.cf file, find the line which indicates inet_protocols and change it to ipv4.
    \nAlso add the following lines of code in the file as shown below:<\/p>\n

    relayhost = [smtp.gmail.com]:587<\/p>\n

    smtp_sasl_auth_enable = yes<\/p>\n

    smtp_sasl_password_maps = hash:\/etc\/postfix\/sasl_passwd<\/p>\n

    smtp_sasl_security_options = noanonymous<\/p>\n

    smtp_tls_CApath = \/etc\/ssl\/certs<\/p>\n

    smtpd_tls_CApath = \/etc\/ssl\/certs<\/p>\n

    smtp_use_tls = yes<\/p>\n<\/div>

    <\/span><\/div><\/div>

    \u00a0<\/p>\n<\/div>

    We now need to create a sasl_password file by typing the command:<\/p>\n

    Sudo gedit \/etc\/postfix\/sasl_passwd<\/p>\n

    In the sasl_passwd file, type the following line of code:<\/p>\n

    [smtp.gmail.com]:587 karaniadharmik100@gmail.com:qpdm abcd efgh ijkl<\/p>\n

    Note:<\/strong><\/h2>\n

    The email address is the email address you want the alerts to be sent to.<\/p>\n

    In order to use Gmail to send alerts, we need to enable two-factor authentication. Furthermore, we need to generate an App Password. The app password is the 12 characters seen above (abcd efgh ijkl)<\/p>\n<\/div>

    <\/span><\/div><\/div>

    \u00a0<\/p>\n<\/div>

    We then run the following commands in the terminal.<\/p>\n

    sudo chmod 400 \/etc\/postfix\/sasl_passwd<\/p>\n

    sudo postmap \/etc\/postfix\/sasl_passwd<\/p>\n

    sudo systemctl restart postfix<\/p>\n

    This completes the setup of Elastalert and Postfix Gmail SMTP.<\/p>\n<\/div>

    Creating the Mimikatz rule<\/strong><\/h2>\n

    I have created the following rule to detect Mimikatz and alert via email when it is run:<\/p>\n<\/div>

    <\/span><\/div><\/div>

    \u00a0<\/p>\n<\/div>

    I save this and we can run Elastalert using the following command:<\/p>\n

    Python3 -m elastalert.elastalert –verbose –rule example_rules\/Mimikatz.yaml<\/p>\n

    It runs as shown below:<\/p>\n<\/div>

    <\/span><\/div><\/div>

    \u00a0<\/p>\n<\/div>

    I then run Mimikatz on my Windows machine where I have configured winlogbeat. It detects and says \u201c2 query hits \u2026 1 alerts sent\u201d.<\/p>\n<\/div>

    <\/span><\/div><\/div>

    \u00a0<\/p>\n<\/div>

    When I check my email, I receive the following alert.<\/p>\n<\/div>

    <\/span><\/div><\/div>

    \u00a0<\/p>\n<\/div>

    References<\/strong><\/h2>\n

    https:\/\/github.com\/justmeandopensource\/elk\/blob\/master\/docs\/elastic-kibana-filebeat-elastalert-notes.md<\/a><\/p>\n

    https:\/\/www.hackingarticles.in\/threat-hunting-log-monitoring-lab-setup-with-elk\/<\/a><\/p>\n

    https:\/\/kifarunix.com\/send-windows-logs-to-elastic-stack-using-winlogbeat-and-sysmon\/<\/a><\/p>\n

    https:\/\/github.com\/justmeandopensource\/elk\/blob\/master\/docs\/elastic-kibana-filebeat-elastalert-notes.md<\/a><\/p>\n

    https:\/\/www.elastic.co\/what-is\/elk-stack<\/a><\/p>\n<\/div>

    <\/div>
    <\/div><\/div>
    <\/div>

    Disclaimer<\/strong><\/h2>\n

    The MacroSec blogs are solely for informational and educational purposes. Any actions and or activities related to the material contained within this website are solely your responsibility. The misuse of the information on this website can result in criminal charges brought against the persons in question. The authors and MacroSec will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law.<\/p>\n<\/div>

    <\/div><\/div><\/div><\/div><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":5,"featured_media":1907,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","footnotes":""},"categories":[12,10,8,13],"tags":[],"class_list":["post-1871","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-defensive-slug","category-offensive-security","category-pentesting","category-red-teaming"],"yoast_head":"\nUsing Elastalert to alert via email when Mimikatz is run. — MacroSEC<\/title>\n<meta name=\"description\" content=\"In this blog, I shall discuss how an alert can be sent via email when Mimikatz is run. Mimikatz is a post-exploitation tool that is used to dump passwords from memory, along with hashes. This allows attackers to conduct various other attacks such as lateral movement more easily. When an attacker gains an initial foothold to a machine, they may run Mimikatz in order to retrieve passwords or passwords hashes. As blue teamers, it is crucial to setup mechanisms to detect attacks and take appropriate measures to safeguard information systems. According to Elastic, "ELK" is the acronym for three open-source projects: Elasticsearch, Logstash, and Kibana. Elasticsearch is a search and analytics engine. Logstash is a server side data processing pipeline that ingests data from multiple sources simultaneously, transforms it, and then sends it to a "stash" like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch. To setup ELK, you can either use the GitHub repository or setup manually. I have setup my stack manually. Once the ELK stack has been installed successfully, the next step is to install Elastalert. To install and setup Elastalert, I shall run the following commands on the terminal window.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Using Elastalert to alert via email when Mimikatz is run. — MacroSEC\" \/>\n<meta property=\"og:description\" content=\"In this blog, I shall discuss how an alert can be sent via email when Mimikatz is run. Mimikatz is a post-exploitation tool that is used to dump passwords from memory, along with hashes. This allows attackers to conduct various other attacks such as lateral movement more easily. When an attacker gains an initial foothold to a machine, they may run Mimikatz in order to retrieve passwords or passwords hashes. As blue teamers, it is crucial to setup mechanisms to detect attacks and take appropriate measures to safeguard information systems. According to Elastic, "ELK" is the acronym for three open-source projects: Elasticsearch, Logstash, and Kibana. Elasticsearch is a search and analytics engine. Logstash is a server side data processing pipeline that ingests data from multiple sources simultaneously, transforms it, and then sends it to a "stash" like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch. To setup ELK, you can either use the GitHub repository or setup manually. I have setup my stack manually. Once the ELK stack has been installed successfully, the next step is to install Elastalert. To install and setup Elastalert, I shall run the following commands on the terminal window.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/\" \/>\n<meta property=\"og:site_name\" content=\"MacroSEC\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-17T13:01:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-04-26T11:55:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/macrosec.tech\/wp-content\/uploads\/2021\/11\/Mimikatz-Alert.png\" \/>\n\t<meta property=\"og:image:width\" content=\"400\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Dharmik Karania\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Dharmik Karania\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/\"},\"author\":{\"name\":\"Dharmik Karania\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#\\\/schema\\\/person\\\/5d4c800b7e603d391fc1db5b09133e25\"},\"headline\":\"Using Elastalert to alert via email when Mimikatz is run.\",\"datePublished\":\"2021-11-17T13:01:31+00:00\",\"dateModified\":\"2022-04-26T11:55:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/\"},\"wordCount\":4272,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Mimikatz-Alert.png\",\"articleSection\":[\"Defensive Security\",\"Offensive Security\",\"Penetration Testing\",\"Red Teaming\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/\",\"name\":\"Using Elastalert to alert via email when Mimikatz is run. — MacroSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Mimikatz-Alert.png\",\"datePublished\":\"2021-11-17T13:01:31+00:00\",\"dateModified\":\"2022-04-26T11:55:16+00:00\",\"description\":\"In this blog, I shall discuss how an alert can be sent via email when Mimikatz is run. Mimikatz is a post-exploitation tool that is used to dump passwords from memory, along with hashes. This allows attackers to conduct various other attacks such as lateral movement more easily. When an attacker gains an initial foothold to a machine, they may run Mimikatz in order to retrieve passwords or passwords hashes. As blue teamers, it is crucial to setup mechanisms to detect attacks and take appropriate measures to safeguard information systems. According to Elastic, \\\"ELK\\\" is the acronym for three open-source projects: Elasticsearch, Logstash, and Kibana. Elasticsearch is a search and analytics engine. Logstash is a server side data processing pipeline that ingests data from multiple sources simultaneously, transforms it, and then sends it to a \\\"stash\\\" like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch. To setup ELK, you can either use the GitHub repository or setup manually. I have setup my stack manually. Once the ELK stack has been installed successfully, the next step is to install Elastalert. To install and setup Elastalert, I shall run the following commands on the terminal window.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/#primaryimage\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Mimikatz-Alert.png\",\"contentUrl\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Mimikatz-Alert.png\",\"width\":400,\"height\":400},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/index.php\\\/2021\\\/11\\\/17\\\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/macrosec.tech\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Using Elastalert to alert via email when Mimikatz is run.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#website\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/\",\"name\":\"MacroSEC\",\"description\":\"Your Cybersecurity Partner - Kenya\",\"publisher\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/macrosec.tech\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#organization\",\"name\":\"MacroSec Ltd\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/MobileIcon_Retine.png\",\"contentUrl\":\"https:\\\/\\\/macrosec.tech\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/MobileIcon_Retine.png\",\"width\":400,\"height\":107,\"caption\":\"MacroSec Ltd\"},\"image\":{\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/macrosec.tech\\\/#\\\/schema\\\/person\\\/5d4c800b7e603d391fc1db5b09133e25\",\"name\":\"Dharmik Karania\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2ad5f76a88ad63937e5cbdf80605c372cf663716add095d320f7a27bf084809e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2ad5f76a88ad63937e5cbdf80605c372cf663716add095d320f7a27bf084809e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2ad5f76a88ad63937e5cbdf80605c372cf663716add095d320f7a27bf084809e?s=96&d=mm&r=g\",\"caption\":\"Dharmik Karania\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Using Elastalert to alert via email when Mimikatz is run. — MacroSEC","description":"In this blog, I shall discuss how an alert can be sent via email when Mimikatz is run. Mimikatz is a post-exploitation tool that is used to dump passwords from memory, along with hashes. This allows attackers to conduct various other attacks such as lateral movement more easily. When an attacker gains an initial foothold to a machine, they may run Mimikatz in order to retrieve passwords or passwords hashes. As blue teamers, it is crucial to setup mechanisms to detect attacks and take appropriate measures to safeguard information systems. According to Elastic, \"ELK\" is the acronym for three open-source projects: Elasticsearch, Logstash, and Kibana. Elasticsearch is a search and analytics engine. Logstash is a server side data processing pipeline that ingests data from multiple sources simultaneously, transforms it, and then sends it to a \"stash\" like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch. To setup ELK, you can either use the GitHub repository or setup manually. I have setup my stack manually. Once the ELK stack has been installed successfully, the next step is to install Elastalert. To install and setup Elastalert, I shall run the following commands on the terminal window.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/","og_locale":"en_US","og_type":"article","og_title":"Using Elastalert to alert via email when Mimikatz is run. — MacroSEC","og_description":"In this blog, I shall discuss how an alert can be sent via email when Mimikatz is run. Mimikatz is a post-exploitation tool that is used to dump passwords from memory, along with hashes. This allows attackers to conduct various other attacks such as lateral movement more easily. When an attacker gains an initial foothold to a machine, they may run Mimikatz in order to retrieve passwords or passwords hashes. As blue teamers, it is crucial to setup mechanisms to detect attacks and take appropriate measures to safeguard information systems. According to Elastic, \"ELK\" is the acronym for three open-source projects: Elasticsearch, Logstash, and Kibana. Elasticsearch is a search and analytics engine. Logstash is a server side data processing pipeline that ingests data from multiple sources simultaneously, transforms it, and then sends it to a \"stash\" like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch. To setup ELK, you can either use the GitHub repository or setup manually. I have setup my stack manually. Once the ELK stack has been installed successfully, the next step is to install Elastalert. To install and setup Elastalert, I shall run the following commands on the terminal window.","og_url":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/","og_site_name":"MacroSEC","article_published_time":"2021-11-17T13:01:31+00:00","article_modified_time":"2022-04-26T11:55:16+00:00","og_image":[{"width":400,"height":400,"url":"https:\/\/macrosec.tech\/wp-content\/uploads\/2021\/11\/Mimikatz-Alert.png","type":"image\/png"}],"author":"Dharmik Karania","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Dharmik Karania","Est. reading time":"18 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/#article","isPartOf":{"@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/"},"author":{"name":"Dharmik Karania","@id":"https:\/\/macrosec.tech\/#\/schema\/person\/5d4c800b7e603d391fc1db5b09133e25"},"headline":"Using Elastalert to alert via email when Mimikatz is run.","datePublished":"2021-11-17T13:01:31+00:00","dateModified":"2022-04-26T11:55:16+00:00","mainEntityOfPage":{"@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/"},"wordCount":4272,"commentCount":0,"publisher":{"@id":"https:\/\/macrosec.tech\/#organization"},"image":{"@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/#primaryimage"},"thumbnailUrl":"https:\/\/macrosec.tech\/wp-content\/uploads\/2021\/11\/Mimikatz-Alert.png","articleSection":["Defensive Security","Offensive Security","Penetration Testing","Red Teaming"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/","url":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/","name":"Using Elastalert to alert via email when Mimikatz is run. — MacroSEC","isPartOf":{"@id":"https:\/\/macrosec.tech\/#website"},"primaryImageOfPage":{"@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/#primaryimage"},"image":{"@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/#primaryimage"},"thumbnailUrl":"https:\/\/macrosec.tech\/wp-content\/uploads\/2021\/11\/Mimikatz-Alert.png","datePublished":"2021-11-17T13:01:31+00:00","dateModified":"2022-04-26T11:55:16+00:00","description":"In this blog, I shall discuss how an alert can be sent via email when Mimikatz is run. Mimikatz is a post-exploitation tool that is used to dump passwords from memory, along with hashes. This allows attackers to conduct various other attacks such as lateral movement more easily. When an attacker gains an initial foothold to a machine, they may run Mimikatz in order to retrieve passwords or passwords hashes. As blue teamers, it is crucial to setup mechanisms to detect attacks and take appropriate measures to safeguard information systems. According to Elastic, \"ELK\" is the acronym for three open-source projects: Elasticsearch, Logstash, and Kibana. Elasticsearch is a search and analytics engine. Logstash is a server side data processing pipeline that ingests data from multiple sources simultaneously, transforms it, and then sends it to a \"stash\" like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch. To setup ELK, you can either use the GitHub repository or setup manually. I have setup my stack manually. Once the ELK stack has been installed successfully, the next step is to install Elastalert. To install and setup Elastalert, I shall run the following commands on the terminal window.","breadcrumb":{"@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/#primaryimage","url":"https:\/\/macrosec.tech\/wp-content\/uploads\/2021\/11\/Mimikatz-Alert.png","contentUrl":"https:\/\/macrosec.tech\/wp-content\/uploads\/2021\/11\/Mimikatz-Alert.png","width":400,"height":400},{"@type":"BreadcrumbList","@id":"https:\/\/macrosec.tech\/index.php\/2021\/11\/17\/using-elastalert-to-alert-via-email-when-mimikatz-is-run\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/macrosec.tech\/"},{"@type":"ListItem","position":2,"name":"Using Elastalert to alert via email when Mimikatz is run."}]},{"@type":"WebSite","@id":"https:\/\/macrosec.tech\/#website","url":"https:\/\/macrosec.tech\/","name":"MacroSEC","description":"Your Cybersecurity Partner - Kenya","publisher":{"@id":"https:\/\/macrosec.tech\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/macrosec.tech\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/macrosec.tech\/#organization","name":"MacroSec Ltd","url":"https:\/\/macrosec.tech\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/macrosec.tech\/#\/schema\/logo\/image\/","url":"https:\/\/macrosec.tech\/wp-content\/uploads\/2018\/04\/MobileIcon_Retine.png","contentUrl":"https:\/\/macrosec.tech\/wp-content\/uploads\/2018\/04\/MobileIcon_Retine.png","width":400,"height":107,"caption":"MacroSec Ltd"},"image":{"@id":"https:\/\/macrosec.tech\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/macrosec.tech\/#\/schema\/person\/5d4c800b7e603d391fc1db5b09133e25","name":"Dharmik Karania","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2ad5f76a88ad63937e5cbdf80605c372cf663716add095d320f7a27bf084809e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2ad5f76a88ad63937e5cbdf80605c372cf663716add095d320f7a27bf084809e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2ad5f76a88ad63937e5cbdf80605c372cf663716add095d320f7a27bf084809e?s=96&d=mm&r=g","caption":"Dharmik Karania"}}]}},"_links":{"self":[{"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/posts\/1871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/comments?post=1871"}],"version-history":[{"count":5,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/posts\/1871\/revisions"}],"predecessor-version":[{"id":1908,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/posts\/1871\/revisions\/1908"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/media\/1907"}],"wp:attachment":[{"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/media?parent=1871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/categories?post=1871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/macrosec.tech\/index.php\/wp-json\/wp\/v2\/tags?post=1871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}