Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Github Ghostpack/safetykatz: Safetykatz is a Combination of Slightly Modified Version of @gentilkiwi's Mimikatz Project and @subtee's .net Pe Loader
Malware Families
Excerpt
https://github.com/GhostPack/SafetyKatz GitHub - GhostPack/SafetyKatz: SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader By HarmJ0y Archived: 2026-10-18 02:47:51 UTC PE Loader. SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET First, the MiniDumpWriteDump Win32 API call is used to create a minidump of LSASS to C:\Windows\Temp\debug.bin. Then…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://blog.gentilkiwi.com/mimikatz | High | Score 67/100 | First seen |
| Domain | against.net | High | Score 67/100 | First seen |
| URL | http://pingcastle.com | High | Score 67/100 | First seen |
| benjamin@gentilkiwi.com | High | Score 67/100 | First seen | |
| URL | http://mysmartlogon.com | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…