Cyber Research Wiki

mimikatz

Open‑source Windows security research tool by Benjamin Delpy (gentilkiwi) best known for extracting credentials from memory and manipulating authentication artifacts (e.g., LSASS contents, Kerberos tickets) and performing directory replication–based credential access (DCSync).

Overview

Mimikatz is a dual‑use credential access and post‑exploitation tool focused on Windows authentication internals. It provides modules that interact with Local Security Authority (LSA/LSASS), Kerberos, Windows cryptographic stores, and the Vault to read, export, or forge authentication artifacts and to simulate domain controller replication requests (DCSync). The tool is widely referenced in incident response, penetration testing, and adversary tradecraft. It is mapped in MITRE ATT&CK as Software S0002 and underpins several credential access techniques, including OS Credential Dumping: DCSync (T1003.006). Platform hardening such as LSASS Protected Process Light and Credential Guard constrains some behaviors on modern systems, but the tool remains prevalent in threat reporting and defensive detections.

What It Is

An open‑source codebase maintained on GitHub by Benjamin Delpy (gentilkiwi) comprising modules for credential extraction and manipulation of authentication artifacts. Key modules include sekurlsa for LSASS memory inspection, kerberos for ticket operations, lsadump for registry/AD secrets and DCSync, crypto for keys and certificates, vault for stored secrets, and token for access token operations. It is used to test defenses against credential theft, simulate Active Directory attack techniques, and study Windows authentication mechanisms.

How It Works

At a systems level, Mimikatz interfaces with Windows authentication subsystems and directory services to surface credential material: (1) LSASS/LSA interaction: with sufficient privileges, the tool inspects the memory of LSASS to enumerate credentials and related secrets (e.g., NTLM hashes, WDigest where present, DPAPI material). LSA Protection (PPL) and Credential Guard restrict or virtualize access, limiting direct dumping on protected hosts. (2) Kerberos manipulation: the kerberos and related modules enumerate, export, and insert Kerberos tickets to support pass‑the‑ticket semantics and can forge ticket‑granting tickets (Golden Tickets) when KRBTGT material is available. (3) DCSync: the lsadump module leverages Active Directory’s Directory Replication Service Remote Protocol (MS‑DRSR), notably IDL_DRSGetNCChanges, to request replication data as though it were a domain controller. Success requires that the calling security principal possess specific replication control access rights on the domain object (DS‑Replication‑Get‑Changes, DS‑Replication‑Get‑Changes‑All, and often DS‑Replication‑Get‑Changes‑In‑Filtered‑Set). Mimikatz can also interact with Windows crypto APIs and key stores to list or export keys and certificates, subject to local protections.

Core Concepts

Typical Workflow

Use Cases

Limitations

Related Tools

Evidence Gaps

Sources

Confidence

high