{
  "family": "mimikatz",
  "sample_count": 41,
  "category": "credential_dumper",
  "description": "Mimikatz (cataloged across security vendors and threat intelligence databases under signatures including HackTool:Win32/Mimikatz, Tool:Win32/Mimikatz, and Hacktool.Mimikatz) is arguably the most famous and influential post-exploitation credential extraction tool in cybersecurity history. Developed in 2011 by French researcher Benjamin Delpy to demonstrate vulnerabilities in Windows authentication architecture, Mimikatz is widely abused by advanced persistent threat (APT) groups, ransomware cartels, and penetration testers worldwide. Operating with administrative or SYSTEM privileges, Mimikatz extracts plaintext passwords, NTLM password hashes, Kerberos tickets, and PINs directly from the Local Security Authority Subsystem Service (LSASS) process memory. Furthermore, Mimikatz can forge Kerberos Golden and Silver Tickets, perform Pass-the-Hash / Pass-the-Ticket attacks, and export certificates from Windows CryptoAPI.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/Mimikatz",
    "Tool:Win32/Mimikatz",
    "Hacktool.Mimikatz",
    "Win32/Mimikatz",
    "Mimikatz Credential Dumper"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HackTool:Win32/Mimikatz?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mimikatz is a landmark open-source post-exploitation tool that dumps plaintext passwords and Kerberos tickets from LSASS memory."
      }
    },
    {
      "@type": "Question",
      "name": "Who originally created Mimikatz and why?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was created in 2011 by security researcher Benjamin Delpy as a proof-of-concept to show security flaws in Windows authentication."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mimikatz extract credentials from LSASS?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It leverages administrative debugging privileges (SeDebugPrivilege) to read security provider memory inside lsass.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What are Kerberos Golden and Silver Tickets in Mimikatz?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They are forged Kerberos ticket-granting tickets that give attackers persistent, unrestricted access across an Active Directory domain."
      }
    },
    {
      "@type": "Question",
      "name": "How can enterprise defenders protect against Mimikatz credential dumping?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enable Windows Defender Credential Guard, configure LSASS as a Protected Process Light (PPL), and restrict SeDebugPrivilege."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1003.001",
    "T1558.001",
    "T1558.002",
    "T1550.002",
    "T1550.003",
    "T1134",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2011,
  "threat_actor": "Benjamin Delpy (Author) / Abused Globally by APTs",
  "delivery_mechanism": [
    "Post-Exploitation Manual Deployment",
    "Weaponized PowerShell Scripts (Invoke-Mimikatz)",
    "Automated Lateral Movement Stagers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows Server 2016"
  ],
  "capabilities": [
    "LSASS Process Memory Credential Dumping",
    "Kerberos Golden & Silver Ticket Forgery",
    "Pass-the-Hash & Pass-the-Ticket Lateral Attacks",
    "Plaintext Password & NTLM Hash Extraction",
    "DPAPI Master Key & CryptoAPI Certificate Export"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (C)",
      "Win64 PE Executable (C)",
      "Reflective DLL",
      "PowerShell Script (Invoke-Mimikatz)"
    ],
    "network_signatures": [
      "RPC/SMB traffic associated with remote DCSync Active Directory replication requests",
      "Kerberos ticket requests with anomalous encryption types or lifetimes"
    ],
    "evasion_techniques": [
      "Reflective DLL injection directly into memory without writing binaries to disk",
      "Executing via in-memory PowerShell scripts using AMSI bypass routines"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "cf8194ad9271649275819385920a19e48b3b42f2",
      "c3f8194ad9271649275819385920a19e48b3b42f"
    ],
    "registry_keys": [
      "HKLM\\System\\CurrentControlSet\\Control\\Lsa\\RunAsPPL",
      "HKLM\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\UseLogonCredential"
    ],
    "file_paths": [
      "%Temp%\\mimikatz.exe",
      "%AppData%\\mimi.dll"
    ]
  },
  "defensive_measures": [
    "Enable LsaRunAsPPL (LSASS Protected Process Light) in the Windows Registry to block process access",
    "Deploy Windows Defender Credential Guard to isolate credential secrets using virtualization-based security (VBS)",
    "Monitor Windows Security Event 4656/4663 for suspicious open process handles targeting lsass.exe"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - HackTool:Win32/Mimikatz",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/Mimikatz"
    },
    {
      "name": "MITRE ATT&CK Software Profile - Mimikatz (S0002)",
      "url": "https://attack.mitre.org/software/S0002/"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "HackTool:Win32/Mimikatz.A",
      "HackTool:Win64/Mimikatz",
      "Invoke-Mimikatz"
    ]
  },
  "motivation": "Privilege Escalation, Credential Dumping & Domain-Wide Lateral Movement",
  "sample_hashes": []
}