{
  "family": "mimikatz",
  "sample_count": 41,
  "category": "ransomware",
  "description": "HackTool:Win32/Mimikatz is arguably the most famous and impactful open-source post-exploitation framework in the history of cybersecurity. Developed by Benjamin Delpy, it was originally created as a proof-of-concept to demonstrate vulnerabilities in Windows authentication. However, it has been globally weaponized by Advanced Persistent Threats (APTs), ransomware operators, and penetration testers to extract plaintext passwords, hashes, and Kerberos tickets directly from system memory.<br><br><b>Understanding Mimikatz</b><br>For the end-user, Mimikatz is entirely invisible. For security analysts, the execution of Mimikatz on a network is a critical emergency. It signifies that an attacker has already bypassed the perimeter, gained administrative privileges on an endpoint, and is actively harvesting credentials to move laterally across the domain, ultimately targeting the Domain Controller.<br><br><b>Execution and Evasion Strategies</b><br>Mimikatz is never the initial infection vector; it is a post-exploitation tool. Attackers drop it onto a machine after achieving `SYSTEM` or `Local Administrator` privileges. Its core functionality revolves around interacting with the Local Security Authority Subsystem Service (`lsass.exe`). Using the `sekurlsa::logonpasswords` module, Mimikatz reads the LSASS memory space (`T1003.001`) to extract plaintext passwords (historically via WDigest), NTLM hashes, and Kerberos Ticket Granting Tickets (TGTs). Attackers utilize these extracted credentials to perform Pass-the-Hash (`T1550.002`) or Pass-the-Ticket (`T1550.003`) attacks. To evade detection, attackers frequently use obfuscated PowerShell versions (e.g., `Invoke-Mimikatz`), heavily modified custom builds, or execute it entirely in memory via Cobalt Strike.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total domain compromise. If an attacker extracts a Domain Admin hash via Mimikatz, the entire network is breached. EDR platforms are heavily tuned to detect Mimikatz. They flag processes attempting to acquire a handle to `lsass.exe` with specific access rights (`PROCESS_VM_READ`). Command-line logging (Event ID 4688) may reveal execution parameters like `sekurlsa::logonpasswords` or `lsadump::sam`. Memory forensics is critical to identify in-memory execution of the framework.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1098",
    "T1003.001",
    "T1550.002",
    "T1055",
    "T1550.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory",
      "tactic": "Credential Access"
    },
    {
      "id": "T1550.002",
      "name": "Use Alternate Authentication Material: Pass the Hash",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1550.003",
      "name": "Use Alternate Authentication Material: Pass the Ticket",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1098",
      "name": "Account Manipulation",
      "tactic": "Persistence"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Declare a high-severity incident immediately; Mimikatz execution implies the attacker already has Administrative privileges on the host.",
    "Isolate the endpoint and assume all credentials of any user who logged into that machine (including Domain Admins) are now compromised.",
    "Initiate a mandatory, enterprise-wide password reset for the compromised accounts, prioritizing elevated and service accounts.",
    "Audit Domain Controller logs (Event ID 4624) for anomalous lateral movement (Pass-the-Hash) originating from the compromised IP address."
  ],
  "what_to_avoid": [
    "Do not assume the threat is contained just by deleting the Mimikatz executable; the attacker already has the hashes and will move laterally.",
    "Avoid relying solely on basic AV; advanced threat actors modify Mimikatz or run it in memory to easily bypass static signatures."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}