mimikatz.exe_: encrypt data using speck

[mike-hunhoff]

Function: 0x420A81

What it does: Massive switch statement processing opcodes (SQLite VM).

Why it matched: The rule matched on a "tight loop" with XOR/Rotate operations. These are present in the SQLite bytecode engine for data manipulation, but it is not the Speck block cipher.

[devarjya27]

Hi @mike-hunhoff, I tried reproducing the issue but was not able to.The rule data-manipulation/encryption/speck does not appear to trigger for me.

│ listen for remote procedure calls (2 matches)            │ communication/rpc/server                     │
│ compress data via WinAPI                                 │ data-manipulation/compression                │
│ decode data using Base64 via WinAPI (2 matches)          │ data-manipulation/encoding/base64            │
│ encode data using Base64 via WinAPI (3 matches)          │ data-manipulation/encoding/base64            │
│ encode data using XOR (14 matches)                       │ data-manipulation/encoding/xor               │
│ create new key via CryptAcquireContext (18 matches)      │ data-manipulation/encryption                 │
│ encrypt or decrypt via WinCrypt (13 matches)             │ data-manipulation/encryption                 │
│ get outbound credentials handle via CredSSP              │ data-manipulation/encryption                 │
│ encrypt data using DES via WinAPI (2 matches)            │ data-manipulation/encryption/des             │
│ encrypt data using DPAPI (2 matches)                     │ data-manipulation/encryption/dpapi           │
│ encrypt data using RC4 PRGA (2 matches)                  │ data-manipulation/encryption/rc4             │
│ encrypt data using RC4 via SystemFunction032 (6 matches) │ data-manipulation/encryption/rc4             │
│ encrypt data using RC4 via WinAPI                        │ data-manipulation/encryption/rc4             │
│ hash data via WinCrypt (4 matches)                       │ data-manipulation/hashing                    │
│ hash data using SHA1                                     │ data-manipulation/hashing/sha1               │
│ hash data using SHA1 via WinCrypt                        │ data-manipulation/hashing/sha1               │
│ authenticate HMAC (2 matches)                            │ data-manipulation/hmac                       │
│ get UEFI variable (2 matches)                            │ host-interaction/bootloader                  │

It’s possible I’m missing a version or environment difference.