Behavior:Win32/MimikatzTrigger

Behavior:Win32/MimikatzTrigger works by altering system configurations to create a compromised environment in the target device. This can include, but are not limited to, the registry changes to re-enable WDigest credential plaintext password caching, removing Windows Defender protections from commands via DisableAntiSpyware=1, and allowing SeDebugPrivilege permits in the middle of the exploit via privilege::debug command.  

Now there exists a situation for the attacker where Mimikatz can be co-opted through a PowerShell command like Invoke-Mimikatz.ps1 to later inject Mimikatz modules into memory without touching the disk. MimikatzTrigger does not steal credentials; it only disables the controls that stop you doing what a standard Mimikatz can do, like LSASS memory scraping that a Windows instance memory contains or Kerberos golden ticket.  

Moreover, MimikatzTrigger as a technique refers to a distinct separation of the "prepare" from the "launch" of compromise creating two states.  

Registry entry set: 

• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender (32-bit Dword value: DisableAntiSpyware=1) 
• HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest (32-bit Dword value: UseLogonCredential=1 
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GraphicsPerfSvcs\Parameters value ServiceDll redirects GraphicsPerfSvcs to fake %AppData%\GraphicsPerfSvcs.dll instead of Windows system dll C:\Windows\System32\GraphicsPerfSvc.dll 

Behavior:Win32/MimikatzTrigger communicates to the following host: 

• a83f[:]8110:0:0:d8ff:ffff:766b[:]e00