excerpt-sysmonconfig-export.xml

<!-- Mimikatz Detection -->
<ImageLoaded condition="is">C:\Windows\System32\WinSCard.dll</ImageLoaded> <!--MimiKatz Detection Credit: @Cyb3rWard0g: https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html -->
<ImageLoaded condition="is">C:\Windows\System32\cryptdll.dll</ImageLoaded> <!--MimiKatz Detection Credit: @Cyb3rWard0g: https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html -->
<ImageLoaded condition="is">C:\Windows\System32\hid.dll</ImageLoaded> <!--MimiKatz Detection Credit: @Cyb3rWard0g: https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html -->
<ImageLoaded condition="is">C:\Windows\System32\samlib.dll</ImageLoaded> <!--MimiKatz Detection Credit: @Cyb3rWard0g: https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html -->
<ImageLoaded condition="is">C:\Windows\System32\vaultcli.dll</ImageLoaded> <!--MimiKatz Detection Credit: @Cyb3rWard0g: https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html -->
<ImageLoaded condition="is">WMINet_Utils.dll</ImageLoaded> <!--MimiKatz Detection Credit: @Cyb3rWard0g: https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html -->
<ImageLoaded condition="contains">\Temp\</ImageLoaded>
<!-- END: Mimikatz Detection -->

mimikatz.yaml

es_host: localhost
es_port: 9200
name: "Mimikatz"
index: elastalert_status
realert:
    minutes: 0
type: cardinality
cardinality_field: rule_name
max_cardinality: 4
filter:
- terms:
    rule_name:
        - winscard
        - cryptdll
        - hid
        - samlib
        - vaultcli
- term:
    alert_sent: true
timeframe:
    seconds: 1
alert:
    - command
command: ["python3","/bin/py-alert.py", "-T","S","-S","SLACKWEBHOOK","-a","Mimikatz","-t","5"]

py-alert.py

#!/usr/bin/python

import sys
from argparse import ArgumentParser
import datetime
import requests
import subprocess
import os

time = datetime.datetime.now().strftime("%H:%M-%y-%m-%d")

def print_banner():
    print('''\npy-alert.py is a tool written to expand the functionality of ElastAlert
    Author: Jordan Potti
    Twitter: @ok_bye_now\n'''
    )

def main():
    global arguments
    parser = ArgumentParser()
    parser.add_argument("-T", dest="action",required=True,help="Action Type: Send Alert (S) or Data Write (D)")
    parser.add_argument("-a", dest="detection",required=True,help="Alert Name")
    parser.add_argument("-c", dest="host",required=False,help="Host to record")
    parser.add_argument("-S", dest="slack",required=False,help="Slack Web Hook")
    parser.add_argument("-t", dest="tripped",required=False,help="Number or Hosts needed to alert")

    if len(sys.argv) == 1:
        print_banner()
        parser.error("No arguments given.")
        parser.print_usage
        sys.exit()

    arguments = parser.parse_args()
    outfile = '/tmp/'+arguments.detection
    if arguments.action == 'D':
        with open (outfile, "a+") as out_file:
            out_file.write(arguments.host+"\n")

    if arguments.action == 'S':
        command = "head -50 %s | sort | uniq -c | gawk '$1>=%s{print $2}'" %(outfile,arguments.tripped) 
        print(command)
        output = os.popen(command).read()
        if output != '':
            output = str(output)
            output = output.replace('b\'','')
            output = output.replace('\\n','')
            out_file = open(outfile, 'w')
            out_file.write("Host: " + output)
            out_file.write("Alert Type: " + arguments.detection+"\n")
            out_file.write("Time: " + time)
            out_file = open(outfile, 'r')
            webhook_url = arguments.slack
            slack_data = {"text":out_file.read()}
            slack_data = str(slack_data)
            slack_data = "payload="+slack_data
            response = requests.post(
                webhook_url, data=slack_data,
                headers={'Content-Type': 'application/x-www-form-urlencoded'})
            if response.status_code != 200:
                raise ValueError('Request to slack returned an error %s, the response is: %s' % (response.status_code, response.text))
            os.remove(outfile)

main()

samlib.yaml

es_host: localhost
es_port: 9200
name: "samlib"
realert:
    minutes: 0
index: winlogbeat-*
filter:
- query:
    wildcard:
        event_data.ImageLoaded: "*samlib*"
type: any
alert:
    - command
command: ["/bin/py-alert.py","-T","D","-a","Mimikatz","-c","%(computer_name)s"]