PE-MIM
mimikatz
Post-exploitation tool for extracting Windows credentials, hashes, and Kerberos tickets from memory.
OVERVIEW
mimikatz reads the LSASS process memory on Windows to recover plaintext passwords, NTLM hashes, and Kerberos tickets cached by the operating system for single sign-on. Its sekurlsa module is the one most engagements reach for, but the tool also covers Kerberos ticket forging (golden/silver tickets), DCSync-style secret extraction from a domain controller, and pass-the-hash/pass-the-ticket replay.
Because it operates directly on credential material held by the OS, it's one of the most heavily signatured tools in the industry: every mainstream AV and EDR product ships detections for its process behavior, memory access patterns, and even static binary signatures, so running it unmodified against a monitored host is rarely stealthy.
USE CASES
Practical use cases
- 01
Dumping plaintext credentials and NTLM hashes from LSASS after obtaining local admin.
- 02
Forging Kerberos golden or silver tickets to persist or escalate within a domain.
- 03
Running DCSync against a domain controller to pull password hashes for arbitrary accounts.
- 04
Replaying captured hashes or tickets via pass-the-hash or pass-the-ticket for lateral movement.
QUICK START
With local admin or SYSTEM on a Windows host already obtained, to extract credentials and tickets for lateral movement.
- Confirm the rules of engagement authorize credential extraction on this host.
- Get an elevated (local admin or SYSTEM) shell on the target Windows machine.
- Launch mimikatz and enable debug privilege before touching LSASS.
- Run the sekurlsa::logonpasswords module to dump cached credentials.
- Document every account and ticket recovered for the report, then dispose of the output per the client's rules.
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exitBEFORE YOU RUN IT
What to check before running it
mimikatz is signature-detected by virtually every AV/EDR product, so document detection expectations with the client before running it unmodified.
Reading LSASS memory requires elevated privileges and can crash the process on some Windows builds — confirm this is acceptable within the change window.
Recovered credentials and tickets are highly sensitive: handle, store, and delete them per the engagement's data-handling rules.