Mimikatz

Overview

HackTool:Win32/Mimikatz is arguably the most famous and impactful open-source post-exploitation framework in the history of cybersecurity. Developed by Benjamin Delpy, it was originally created as a proof-of-concept to demonstrate vulnerabilities in Windows authentication. However, it has been globally weaponized by Advanced Persistent Threats (APTs), ransomware operators, and penetration testers to extract plaintext passwords, hashes, and Kerberos tickets directly from system memory.

Understanding Mimikatz
For the end-user, Mimikatz is entirely invisible. For security analysts, the execution of Mimikatz on a network is a critical emergency. It signifies that an attacker has already bypassed the perimeter, gained administrative privileges on an endpoint, and is actively harvesting credentials to move laterally across the domain, ultimately targeting the Domain Controller.

Execution and Evasion Strategies
Mimikatz is never the initial infection vector; it is a post-exploitation tool. Attackers drop it onto a machine after achieving `SYSTEM` or `Local Administrator` privileges. Its core functionality revolves around interacting with the Local Security Authority Subsystem Service (`lsass.exe`). Using the `sekurlsa::logonpasswords` module, Mimikatz reads the LSASS memory space (`T1003.001`) to extract plaintext passwords (historically via WDigest), NTLM hashes, and Kerberos Ticket Granting Tickets (TGTs). Attackers utilize these extracted credentials to perform Pass-the-Hash (`T1550.002`) or Pass-the-Ticket (`T1550.003`) attacks. To evade detection, attackers frequently use obfuscated PowerShell versions (e.g., `Invoke-Mimikatz`), heavily modified custom builds, or execute it entirely in memory via Cobalt Strike.

Indicators of Compromise & Impact
The impact is total domain compromise. If an attacker extracts a Domain Admin hash via Mimikatz, the entire network is breached. EDR platforms are heavily tuned to detect Mimikatz. They flag processes attempting to acquire a handle to `lsass.exe` with specific access rights (`PROCESS_VM_READ`). Command-line logging (Event ID 4688) may reveal execution parameters like `sekurlsa::logonpasswords` or `lsadump::sam`. Memory forensics is critical to identify in-memory execution of the framework.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_MIMIKATZ {
    meta:
        description = "Detects Mimikatz (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "mimikatz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Mimikatz Activity
id: aa623a8a2a34729b095ffaf5b48d48b0
status: experimental
description: Detects generic indicators of the mimikatz malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*mimikatz*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Declare a high-severity incident immediately; Mimikatz execution implies the attacker already has Administrative privileges on the host.
2. Isolate the endpoint and assume all credentials of any user who logged into that machine (including Domain Admins) are now compromised.
3. Initiate a mandatory, enterprise-wide password reset for the compromised accounts, prioritizing elevated and service accounts.
4. Audit Domain Controller logs (Event ID 4624) for anomalous lateral movement (Pass-the-Hash) originating from the compromised IP address.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the threat is contained just by deleting the Mimikatz executable; the attacker already has the hashes and will move laterally.
2. Avoid relying solely on basic AV; advanced threat actors modify Mimikatz or run it in memory to easily bypass static signatures.

References & External Analysis

• Search "mimikatz" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Wakme
• Batlauncher
• Kryptyk
• Imali
• Paradise

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/mimikatz.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.