thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Mimikatz

A post-exploitation tool that extracts plaintext passwords, hashes, Kerberos tickets and other credentials from Windows memory.

Definition

Mimikatz reads credentials from the LSASS process and enables attacks such as pass-the-hash, pass-the-ticket, golden ticket and DCSync. Its presence or LSASS access by unusual processes is a strong compromise indicator. Credential Guard, LSA protection and removing admin rights reduce its effectiveness.

Example

sekurlsa::logonpasswords dumps credentials of users logged on to the host.

Exam tip

Mimikatz is tied to credential dumping (T1003); LSASS protection and Credential Guard are the mitigations.

Related terms