Mimikatz

What Mimikatz Is and What It Extracts From Windows Memory

• Mimikatz is an open-source post-exploitation tool developed by Benjamin Delpy that extracts plaintext passwords, NTLM hashes, Kerberos tickets, PINs, and certificates from Windows memory.
• MITRE ATT&CK maps credential dumping to T1003 (OS Credential Dumping) with sub-techniques: T1003.001 (LSASS Memory), T1003.002 (Security Account Manager), T1003.006 (DCSync).
• Mimikatz is the reference implementation for all of these techniques.
• The tool is not malware — it is a research tool that interacts with Windows authentication subsystems at the API level — but it is used in virtually every ransomware attack and APT intrusion because it enables lateral movement (map AD attack paths with BloodHound), privilege escalation, and persistence.

Credential Extraction Commands — What Mimikatz Actually Does

LSASS Memory Dump (sekurlsa::logonpasswords)

The most famous Mimikatz command. It accesses the LSASS process (Local Security Authority Subsystem Service) and extracts credentials stored in memory — including plaintext passwords, NTLM hashes, and Kerberos tickets.

mimikatz # sekurlsa::logonpasswords

What it extracts:

Why this works: Windows caches credentials in LSASS so users can seamlessly access network resources without re-entering passwords. WDigest (disabled in Windows 8.1+/2012 R2+) stored plaintext passwords in memory by default. Even without WDigest, NTLM hashes and Kerberos tickets remain accessible via sekurlsa::logonpasswords.

DCSync (lsadump::dcsync)

A more powerful technique that does not require code execution on a Domain Controller. Instead, the attacker uses a Domain Admin account to replicate domain data from a DC — just like another DC would. This gives them every user’s NTLM hash and Kerberos key in the domain.

mimikatz # lsadump::dcsync /user:krbtgt

Why DCSync is so dangerous: It extracts the krbtgt account hash, which allows the attacker to forge Golden Tickets — Kerberos TGTs that grant access to any resource in the domain. DCSync does not leave a process access event on the target DC because it uses DRSUAPI (Directory Replication Service) — a legitimate domain replication protocol.

SAM Registry Dump (lsadump::sam)

Dumps the local SAM (Security Account Manager) registry hive to extract local user password hashes. Requires local administrator privileges.

mimikatz # lsadump::sam

Kerberos Ticket Extraction and Manipulation

Token Manipulation (token::elevate)

Switches Mimikatz’s execution context to SYSTEM privileges. Essential because LSASS runs as SYSTEM — Mimikatz needs SYSTEM access to read LSASS memory.

mimikatz # token::elevate
mimikatz # sekurlsa::logonpasswords

Detection — How to Find Mimikatz Running in Your Environment

Mimikatz is detectable at multiple layers: process-level signatures, event log patterns, network behavior, and memory artifacts. The most effective detection combines all four.

Detection Layer 1 — Process and Command-Line Detection

Sysmon Event ID 1 (Process Creation) with CommandLine logging:

Mimikatz often uses distinctive command-line patterns, especially when launched via PowerShell or Cobalt Strike:

SPL query — detect Mimikatz command-line patterns:

index=windows sourcetype=WinEventLog:Sysmon EventCode=1
| search CommandLine IN ("*sekurlsa::logonpasswords*", "*lsadump::dcsync*", "*lsadump::sam*", "*kerberos::golden*", "*token::elevate*")
| eval severity = "CRITICAL — Mimikatz or similar credential dumping tool detected"
| table _time, Computer, User, Image, CommandLine, severity

SPL query — detect LSASS process access by non-LSASS processes (Sysmon Event ID 10) — run in Splunk:

index=windows sourcetype=WinEventLog:Sysmon EventCode=10
| search TargetImage="*lsass.exe" SourceImage!="*wmiprvse.exe" SourceImage!="*svchost.exe" SourceImage!="*Lsaiso.exe"
| stats count, values(SourceImage) as SourceProcesses by Computer, TargetImage, GrantedAccess
| eval alert = if(GrantAccess=0x1FFFFF, "HIGH — LSASS memory read by non-standard process — credential dumping likely", "MEDIUM — LSASS accessed by non-standard process — investigate")
| table _time, Computer, SourceProcesses, GrantedAccess, alert

GrantedAccess codes that indicate credential dumping:

Detection Layer 2 — Windows Security Event Logs

Event ID 4688 (Process Creation with CommandLine):

If Sysmon is not deployed, native Windows Event ID 4688 (when configured with command-line auditing) can detect Mimikatz:

index=windows sourcetype=WinEventLog:Security EventCode=4688
| search CommandLine IN ("*sekurlsa*", "*logonpasswords*", "*dcsync*", "*golden*")
| eval alert = "CRITICAL — potential credential dumping detected via Windows Event 4688"
| table _time, Computer, SubjectUserName, ProcessName, CommandLine

Event ID 4670 (Process Access - SACL auditing):

When SACLs are configured on LSASS, Event 4670 logs access attempts:

auditpol /set /subcategory:"Detailed Process Tracking" /success:enable /failure:enable

Then query:

index=windows sourcetype=WinEventLog:Security EventCode=4670
| search ObjectName="*lsass.exe" Accesses="*PROCESS_ALL_ACCESS*"

Detection Layer 3 — PowerShell and Script-Based Detection

Mimikatz is frequently loaded in-memory via PowerShell (Reflective DLL Loading) to avoid writing the binary to disk:

SPL query — detect Mimikatz in PowerShell logs:

index=windows sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventID=4103
| search ScriptBlockText IN ("*mimikatz*", "*Mimikatz*", "*Invoke-Mimikatz*", "*sekurlsa*", "*DCSync*", "*logonpasswords*")
| eval alert = "CRITICAL — Mimikatz loaded in PowerShell — in-memory credential dumping"
| table _time, Computer, UserID, ScriptBlockText, alert

SPL query — detect PowerShell reflection loading (no Mimikatz string, anomalous behavior):

index=windows sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventID=4104
| search ScriptBlockText="*System.Reflection.Assembly*Load*" ScriptBlockText="*byte[*"
| eval alert = "HIGH — PowerShell loading .NET assembly from byte array — possible reflective DLL injection"
| table _time, Computer, ScriptBlockText, alert

KQL query — detect Mimikatz via PowerShell in Microsoft 365 Defender:

DeviceProcessEvents
| where FileName == "powershell.exe" or FileName == "pwsh.exe"
| where ProcessCommandLine has_all ("sekurlsa", "logonpasswords") or
        ProcessCommandLine has_any ("Invoke-Mimikatz", "DCSync", "mimikatz")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| sort by Timestamp desc

Detection Layer 4 — Network Indicators

While Mimikatz is primarily a host-based tool, DCSync uses DRSUAPI replication — which is detectable on the network:

SPL query — detect DCSync via Directory Service log (Event ID 4662):

index=windows sourcetype=WinEventLog:Security EventCode=4662
| search AccessMask="0x100" PropertyName="*DS-Replication-Get-Changes*"
| eval alert = "CRITICAL — DCSync detected via Directory Service access"
| table _time, Computer, SubjectUserName, ObjectName, PropertyName, alert

Detection Layer 5 — Memory Artifacts

If you have access to a memory dump (from a forensic acquisition):

Prevention — Making Mimikatz Extraction Harder

Implementation order (most effective first):

1. Credential Guard + LSASS RunAsPPL — stops the vast majority of mimikatz attacks
2. Disable WDigest — prevents plaintext password extraction
3. ASR Rule for LSASS — blocks the process access pattern
4. Enable command-line logging — detects what gets past the first three layers

Mimikatz Triage — Investigation Workflow

Step 1: Confirm the Detection

Step 2: Determine Scope

• Which account executed Mimikatz? Was it a standard user (escalated), or an admin? Check Event 4688 for SubjectUserName.
• What credentials were extracted? Any user logged on to the compromised system had their credentials cached in LSASS — assume all are compromised.
• How was Mimikatz delivered? Dropped as a file? In-memory PowerShell? Cobalt Strike execute-assembly?

Step 3: Immediate Containment

1. Isolate the host — disconnect from the network immediately
2. Check for lateral movement — search for pass-the-hash authentication from the compromised host (Event 4624 Logon Type 3 with same NTLM hash)
3. Reset the krbtgt password — if DCSync was performed, assume Golden Tickets exist
4. Reset all service account passwords — service account hashes are cached in LSASS
5. Rotate all credentials that were active on the compromised system during the extraction window

Step 4: Forensic Preservation

• Capture a full memory dump (Mimikatz artifacts persist until the system is rebooted)
• Capture the original binary or PowerShell script that loaded Mimikatz
• Preserve Sysmon and Windows Event Logs with a 30-second offset before and after the event

Related

• Metasploit — detection and response for T1203 techniques
• Active Directory Basics — covers the active directory basics concepts
• EDR Basics — detection and response for T1059, T1003, T1055, T1204, T1562 techniques
• Indicators: IoC, IoA, and TTP — covers the indicators: ioc, ioa, and ttp concepts
• Log Sources Overview — covers the log sources overview concepts

Sources

• Benjamin Delpy — Mimikatz
• MITRE ATT&CK T1003
• MITRE ATT&CK T1003.001
• Microsoft — Credential Guard
• Microsoft — Detecting and Mitigating Credential Theft
• Sysmon Event ID 10 — Process Access