{
  "Event": {
    "analysis": "2",
    "date": "2016-08-13",
    "extends_uuid": "",
    "info": "Rule to detect KirBi ticket for Mimikatz by Benjamin Delpy with Contribution of Didier Stevens",
    "publish_timestamp": "1471358866",
    "published": true,
    "threat_level_id": "4",
    "timestamp": "1471358862",
    "uuid": "57b3273b-7588-4042-9276-4eb4950d210f",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471358806",
        "to_ids": true,
        "type": "yara",
        "uuid": "57b32756-3d4c-457f-b651-4357950d210f",
        "value": "rule mimikatz_kirbi_ticket\r\n{\r\n\tmeta:\r\n\t\tdescription\t\t= \"KiRBi ticket for mimikatz\"\r\n\t\tauthor\t\t\t= \"Benjamin DELPY (gentilkiwi); Didier Stevens\"\r\n\r\n\tstrings:\r\n\t\t$asn1\t\t\t= { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }\r\n\t\t$asn1_84\t\t= { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }\r\n\r\n\tcondition:\r\n\t\t$asn1 at 0 or $asn1_84 at 0\r\n}"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471358817",
        "to_ids": false,
        "type": "link",
        "uuid": "57b32761-e19c-462f-b657-4ffe950d210f",
        "value": "https://github.com/Neo23x0/signature-base/blob/master/yara/gen_kirbi_mimkatz.yar"
      }
    ]
  }
}