Mimikatz is an open-source Windows post-exploitation tool, written by Benjamin Delpy, that extracts credentials from a compromised machine: NTLM hashes and plaintext passwords from LSASS memory, Kerberos tickets, and domain hashes via DCSync. It also forges Kerberos tickets (Golden and Silver). It needs local administrator rights to read LSASS, and it is the reference implementation for most Active Directory credential attacks. Defenders use the same tool to test exposure.
What Mimikatz is
Mimikatz is a credential tool that turned several Windows internals into one-line attacks. Its main modules:
- sekurlsa: reads credentials from LSASS memory (hashes, tickets, sometimes plaintext).
- lsadump: dumps secrets including DCSync against a Domain Controller.
- kerberos: forges and injects tickets, including Golden and Silver tickets.
It is widely used because it is reliable and well-documented. The same capabilities that make it an attacker favourite make it a standard tool in an authorised penetration test.
What it does and payload
The common Mimikatz commands map directly to AD attacks:
- Harvest credentials from memory:
sekurlsa::logonpasswords - Steal the KRBTGT hash via replication:
lsadump::dcsync /user:krbtgt - Forge a Golden Ticket:
kerberos::golden /user:Administrator /sid:<SID> /krbtgt:<hash> /ptt
Reading LSASS requires local administrator or SYSTEM rights, which is why the first foothold and any local escalation matter. Shown here for defensive context.
How to defend
- Enable Credential Guard to isolate LSASS secrets from tools like Mimikatz.
- Use the Protected Users group and LSASS protection (RunAsPPL).
- Keep Domain Admins off ordinary machines so their credentials are never cached where Mimikatz runs.
- Deploy LAPS so a harvested local-admin hash does not unlock other machines.
- Detect processes opening a handle to
lsass.exeand abnormal Kerberos ticket activity.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE)
- [2]Microsoft: Kerberos Authentication Overview(Microsoft)
- [3]NIST SP 800-115 Technical Guide to Security Testing(NIST)