Mimikatz is the most consequential post-exploitation tool ever written for Windows. Created by Benjamin Delpy (gentilkiwi), it turned credential theft from an academic curiosity into a two-command operation and reshaped how every enterprise thinks about lateral movement. If you defend Active Directory, you cannot detect what you have never watched run.
This guide is written for blue teamers, SOC analysts and authorised red teamers. You will build a safe, isolated lab, install Mimikatz three different ways, walk through every core module (sekurlsa, lsadump, kerberos), and then flip to defence with paired Sentinel KQL and Splunk SPL detections, Sysmon tuning, and the hardening controls that actually break the tool.
Legal & ethical note: Only run Mimikatz on systems you own or are explicitly authorised in writing to test. Everything below assumes an isolated lab you control. Credential theft against systems you do not own is a crime in most jurisdictions.
◈ Table of Contents
01 — What Mimikatz Is & How It Works
SECURITY CONTEXT
Windows keeps authentication material in memory so that users are not prompted for their password on every network resource — this is what makes Single Sign-On (SSO) possible. That material lives inside the Local Security Authority Subsystem Service, lsass.exe. Each authentication package — WDigest, Kerberos, MSV1_0 (NTLM), TSpkg, LiveSSP — caches secrets in its own structures. Mimikatz enables the SeDebugPrivilege, opens a handle to the LSASS process, reads those structures directly out of RAM and decrypts them using keys that also live in the same process. No exploit and no CVE are required: it abuses functionality that is working exactly as designed.
Plaintext Password Recovery
On legacy or misconfigured hosts where WDigest caching is enabled, Mimikatz recovers cleartext passwords directly from LSASS — no cracking required.
Hash & Ticket Theft
Even on hardened hosts it extracts NTLM hashes and Kerberos tickets, which fuel Pass-the-Hash and Pass-the-Ticket lateral movement without ever knowing a password.
Domain Dominance
With DCSync it impersonates a domain controller to pull the KRBTGT hash, then forges Golden Tickets that grant near-permanent access to the entire forest.
Why Defenders Study It
Mimikatz code is embedded in Cobalt Strike, Metasploit and countless ransomware toolkits. Watching it run in a lab is how you learn to write detections that hold up in production.
Mimikatz is not a single trick. Think of it as a Swiss-army toolkit of ~20 modules. The credential-dumping fame comes from one module — sekurlsa — but the kerberos and lsadump modules are what enable full domain takeover.
02 — Prerequisites & Lab Setup
ALL METHODSNever run Mimikatz on a corporate or internet-connected machine you rely on. Build an isolated lab — a couple of VMs on a host-only or internal network with no route to production. If you already followed our Active Directory Home Lab guide, that Windows Server 2022 domain controller plus a domain-joined Windows 11 workstation is the perfect target set.
| Component | Recommended | Purpose | Notes |
|---|---|---|---|
| Hypervisor | VirtualBox / VMware / Proxmox / Hyper-V | Host the lab VMs | Use host-only or internal networking — no NAT to the internet during testing. |
| Domain Controller | Windows Server 2022 rec | AD DS, DCSync target | 4 GB RAM min. Create a test domain such as lab.local. |
| Workstation | Windows 10/11 (domain-joined) | Credential-dumping target | Log in with a domain user so credentials are cached in LSASS. |
| Privileges | Local Administrator / SYSTEM | Required to read LSASS | Mimikatz cannot dump LSASS without elevation. This is by design. |
| Toolkit | Sysmon + Windows Event Forwarding | Generate detection telemetry | Install Sysmon before you run Mimikatz so you capture the events. |
Modern Microsoft Defender and virtually every AV will delete mimikatz.exe on sight. In an isolated LAB ONLY, add a Defender exclusion so you can study the tool. Never disable AV on a production or internet-facing host.
Take a VM snapshot of a clean, Sysmon-instrumented state before every test run. You will want to roll back and re-run the same attack to fine-tune detections without cross-contaminating your logs.
03 — Method 1: Precompiled Release (Bare Metal)
FASTESTThe only trustworthy source is Benjamin Delpy's own repository. Do not download "mimikatz" from random mirrors — many are trojanised. Grab the latest mimikatz_trunk.zip from the Releases page.
The archive contains x64\mimikatz.exe and Win32\mimikatz.exe. The rule is simple: the Mimikatz architecture must match the target LSASS process. On a 64-bit Windows host — which is everything modern — LSASS is 64-bit, so you use the x64 build. Running the 32-bit build against 64-bit LSASS is the single most common beginner mistake.
You MUST launch mimikatz from an elevated (Administrator) console. Right-click cmd.exe → Run as administrator. Without elevation, privilege::debug will fail and every sekurlsa command returns an error.
Two commands set up every session. log writes all output to a file so you can review it later, and privilege::debug enables SeDebugPrivilege, which grants the handle rights needed to read LSASS.
If privilege::debug returns "ERROR ... Debug (20) OK" it actually succeeded — the word ERROR is Mimikatz being noisy. A genuine failure says the privilege was not assigned, which means you are not running elevated.
04 — Method 2: Build From Source (Visual Studio)
CONTROLCompiling your own binary changes the file hash on every build, which is exactly why red teams do it — signature-only AV rules that key on the release hash miss a fresh compile. For defenders, building from source teaches you why hash-based blocklists are a losing game and pushes you toward behavioural detection.
Install Visual Studio 2022 Community with the "Desktop development with C++" workload, plus the Windows SDK. Then clone the repository with git.
Open mimikatz.sln in Visual Studio and build in Release / x64, or drive it headlessly from the Developer PowerShell with msbuild. The output lands in x64\mimikatz.exe.
The mimidrv.sys kernel driver used by some modules is signed by gentilkiwi. If you self-compile, the driver may fail to load on hosts that enforce driver signature verification. Stick to the released, signed driver for module::mimidrv work.
05 — Method 3: In-Memory / Fileless Execution
EVASIVEThe way Mimikatz appears in the majority of real intrusions is fileless — the mimikatz.exe binary never touches disk. Red teams reflectively load the PE into memory from PowerShell, or split the operation entirely: dump LSASS to a file with a living-off-the-land binary, then parse it offline on their own machine. Understanding both is essential for detection.
The classic Invoke-Mimikatz script (originally from PowerSploit) reflectively loads the Mimikatz DLL into the PowerShell process, so nothing is written to disk. It is heavily signatured now, but the technique is what matters for hunting.
This is why PowerShell Script Block Logging (Event ID 4104) and AMSI are gold for defenders — reflective loaders still surface the decoded command text and API calls to those telemetry sources even when the file never hits disk.
A signed Windows DLL, comsvcs.dll, exposes a MiniDump export. Attackers use it to write LSASS memory to a .dmp file with no third-party tool, exfiltrate it, then run Mimikatz against the dump on an air-gapped analysis box. This defeats any detection that only watches for mimikatz.exe on the victim.
The comsvcs.dll MiniDump technique is one of the most common LSASS-dumping methods in real ransomware intrusions precisely because it uses only signed Microsoft binaries. Your detections must cover the DUMP action, not just the mimikatz filename.
06 — Core Modules & Commands
REFERENCE
Commands follow the pattern module::command. Here are the modules you will use most, ranked by how often they appear in real intrusions.
| Module | Key Commands | What It Does |
|---|---|---|
| privilege | privilege::debug | Enables SeDebugPrivilege — the prerequisite for reading LSASS. |
| token | token::elevate | Impersonates a SYSTEM token — needed for SAM/LSA secrets access. |
| sekurlsa | logonpasswords, ekeys, pth, tickets | Reads passwords, hashes, Kerberos keys and tickets from LSASS memory. |
| lsadump | sam, secrets, lsa, dcsync | Dumps the local SAM, LSA secrets, and (via replication) domain hashes. |
| kerberos | golden, ptt, list | Forges and injects Kerberos tickets — Golden and Silver Tickets. |
| crypto | certificates, keys | Exports certificates and private keys, including non-exportable ones. |
| vault / dpapi | vault::cred, dpapi::masterkey | Recovers Windows Credential Manager and DPAPI-protected secrets. |
| misc | misc::skeleton | Injects a "skeleton key" into a DC so a master password works everywhere. |
MODULE-TO-KILL-CHAIN MAP — where each Mimikatz command sits in an intrusion.
07 — Credential Dumping Walkthrough
HANDS-ONThe headline command. It walks every authentication package in LSASS and prints whatever it finds — NTLM hash, SHA1, and cleartext where WDigest is enabled.
On Windows 8.1 / Server 2012 R2 and later, WDigest cleartext caching is OFF by default, so the Password field shows (null). Seeing a real cleartext password here almost always means the host was deliberately weakened — a finding in itself.
Where logonpasswords gives you the NTLM hash, sekurlsa::ekeys gives the AES256/AES128 Kerberos keys — which are far more useful for stealthy Overpass-the-Hash on Kerberos-only environments.
The SAM holds local account hashes; LSA secrets hold service-account passwords, cached domain logons and auto-logon credentials. Both need a SYSTEM token first, so run token::elevate.
lsadump::secrets frequently reveals cleartext service-account and scheduled-task passwords that admins assumed were safe. Treat any account exposed here as fully compromised and rotate it.
This writes every cached TGT and service ticket to .kirbi files in the working directory, ready to be replayed with Pass-the-Ticket on another host.
- NTLM hashes captured for at least one privileged account
- Kerberos AES keys and tickets exported to disk
- Local SAM and LSA secrets dumped
- Full session written to your mimikatz .log file
Beyond LSASS, Windows stores saved passwords — RDP credentials, browser logins, scheduled-task secrets — in the Credential Manager vault, encrypted with DPAPI. Mimikatz reads the vault and, with the user's DPAPI master key (also recoverable from LSASS), decrypts blobs that survive a reboot.
DPAPI abuse is why "remember my password" is dangerous on shared or high-value hosts. Master keys pulled from one session can decrypt that user's saved secrets offline, long after the original logon has ended.
08 — Pass-the-Hash & Pass-the-Ticket
LATERAL MOVEMENTThe power of Mimikatz is that you never need to crack anything. NTLM authentication proves you know the hash, not the password — so the hash is the credential. Pass-the-Hash (PtH) reuses an NTLM hash; Pass-the-Ticket (PtT) replays a stolen Kerberos ticket.
This spawns a new process (here, cmd.exe) whose network authentication uses the supplied NTLM hash. From that shell, tools like psexec or wmic authenticate to remote hosts as the victim user.
Inject one of the .kirbi tickets you exported earlier into your current session, then confirm it landed with klist or kerberos::list.
Overpass-the-Hash bridges the two: feed an AES key from sekurlsa::ekeys into sekurlsa::pth with /aes256 to request a legitimate Kerberos TGT. It is stealthier than raw PtH because it produces normal-looking Kerberos traffic.
Raw Pass-the-Hash relies on NTLM, which stands out in Kerberos-first environments. Overpass-the-Hash instead uses a stolen key to request a real TGT from the KDC, so the follow-on traffic looks like ordinary Kerberos. This is the technique mature red teams prefer for stealth.
Because Overpass-the-Hash produces valid Kerberos tickets, NTLM-focused detections miss it. Hunt instead for TGT requests (Event 4768) that originate from a workstation shortly after an LSASS-access alert on the same host.
09 — DCSync & Golden Ticket
DOMAIN DOMINANCEDCSync abuses the Directory Replication Service. With the replication rights that Domain Admins hold by default, Mimikatz asks a real DC to replicate account secrets — without ever running code on the DC itself. The prize is the krbtgt account hash.
DCSync only requires the "Replicating Directory Changes All" right — not interactive logon to a DC. Any account granted that right (sometimes by accident via delegation) can perform it, which is why auditing replication rights is critical.
With the KRBTGT hash and the domain SID, Mimikatz forges a Ticket-Granting Ticket for any user — including a non-existent one — with arbitrary group membership. The DC trusts it because it is signed with the real KRBTGT key.
The only durable fix for a stolen KRBTGT hash is to reset the krbtgt account password TWICE (waiting for replication between resets). One reset is not enough because the DC keeps the current and previous password to validate in-flight tickets.
10 — Detection & Threat Hunting
BLUE TEAMFilename and hash signatures are the weakest possible defence — a recompile or reflective load defeats them. Durable detection watches behaviour: who is opening a handle to LSASS, what command lines contain Mimikatz-specific strings, and which accounts are requesting directory replication. Below, each query is paired KQL (Microsoft Sentinel / Defender XDR) and SPL (Splunk). Install Sysmon with a good config (SwiftOnSecurity or Olaf Hartong's sysmon-modular) to generate the telemetry.
| GrantedAccess | Rights Requested | Relevance |
|---|---|---|
| 0x1010 | PROCESS_VM_READ + QUERY_LIMITED_INFORMATION | Classic read-only LSASS access used by sekurlsa credential reads. |
| 0x1410 | QUERY + VM_READ + DUP_HANDLE | Common in memory-dumping tooling; strong Mimikatz indicator. |
| 0x143a | Read + write + operation rights | Historically hard-coded by Mimikatz — high-fidelity signal. |
| 0x1438 / 0x1fffff | Broad or full access | Full-access opens to LSASS are rare and worth alerting on outright. |
Sysmon Event ID 10 fires when a process opens a handle to another. Credential dumpers request specific access masks to LSASS — 0x1010, 0x1410 and 0x143a are the classic Mimikatz values. This is the single highest-value detection for credential theft.
Baseline first. Legitimate security products (EDR, AV) also open LSASS handles. Exclude their known SourceImage paths, then alert on everything that remains — an unknown process reading LSASS is nearly always malicious.
Even fileless loaders often pass Mimikatz command strings on the command line. Hunt process-creation events (Sysmon EID 1 / Security 4688 / Defender DeviceProcessEvents) for the tell-tale module::command syntax.
DCSync generates Directory Service Access event 4662 on the DC with the replication extended-rights GUIDs. A replication request from an account that is not a domain controller is a near-certain DCSync attack.
Filter out legitimate DC computer accounts (names ending in $) and known sync accounts such as Azure AD Connect (MSOL_). Everything else requesting replication is an incident — escalate immediately.
Catch the fileless variants: PowerShell Script Block Logging (Event ID 4104) reveals reflective loader text, and Sysmon FileCreate (EID 11) or process-creation logs catch the comsvcs.dll MiniDump technique writing an lsass dump.
A honeytoken is a decoy account — plausible name, real Kerberos SPN, high-looking privileges — that no human ever uses. Seed its credentials into places attackers loot (a script, a shared drive) and alert on any authentication attempt. Because legitimate use is zero, the false-positive rate is effectively nil.
Honeytokens catch the attacker AFTER credential theft but BEFORE damage — the moment they try the "juicy" account they found. It is one of the cheapest, highest-signal detections you can deploy against Mimikatz-fuelled lateral movement.
| Mimikatz Action | Primary Event | MITRE ATT&CK |
|---|---|---|
| sekurlsa::logonpasswords | Sysmon EID 10 (LSASS access) | T1003.001 — LSASS Memory |
| comsvcs.dll MiniDump | Process 4688 + FileCreate 11 | T1003.001 / T1218.011 |
| lsadump::sam | Registry / SYSTEM token use | T1003.002 — SAM |
| lsadump::dcsync | Security 4662 (replication) | T1003.006 — DCSync |
| sekurlsa::pth | Logon 4624 Type 9 + 4672 | T1550.002 — Pass-the-Hash |
| kerberos::golden | Anomalous TGT lifetime / 4769 | T1558.001 — Golden Ticket |
11 — Defense & Hardening
PREVENTIONYou cannot patch Mimikatz away — it abuses designed behaviour. But you can make LSASS unreadable, remove the cleartext secrets it feeds on, and shrink the blast radius when a single host falls. Apply these in order.
Running LSASS as a Protected Process Light blocks non-protected processes — including Mimikatz — from opening a read handle. On Windows 11 22H2+ it is increasingly on by default; enforce it everywhere.
Kill the source of plaintext passwords. This is default-off on modern Windows, but attackers flip it back on to weaken a host — enforce 0 by policy and alert on any change.
Windows Defender Credential Guard uses virtualization-based security to isolate LSASS secrets in a separate, hardware-protected process that Mimikatz cannot reach. Pair it with the Defender ASR rule that blocks credential stealing from LSASS.
Credential Guard does not protect local SAM accounts or stop DCSync. Layer it with LAPS (unique local admin passwords), tiered admin, and the principle that Domain Admins never log on to workstations.
Assume one host will fall. The controls that matter are the ones that stop a single stolen credential from becoming domain-wide compromise.
- 1Tiered administration: Tier-0 (DC/identity) admins never authenticate to Tier-1/2 assets, so their hashes never land in a workstation's LSASS.
- 2LAPS: unique, rotated local Administrator passwords defeat lateral Pass-the-Hash with a local account.
- 3Audit replication rights: only DCs and vetted sync accounts should hold DS-Replication-Get-Changes-All.
- 4Protected Users group + Kerberos armoring: members get no NTLM, no WDigest and no long-lived caching.
- 5Reset krbtgt twice if a Golden Ticket is ever suspected, and rotate any account revealed by lsadump.
Common errors & fixes — the failures you will hit in the lab and what they actually mean:
| Symptom | Cause | Fix |
|---|---|---|
| "ERROR kuhl_m_sekurlsa_acquireLSA" | Not elevated, or LSA Protection (RunAsPPL) is blocking the handle | Run console as Administrator; if PPL is on, that is the control working — dump offline instead |
| mimikatz.exe deleted on download | Defender / AV signature match | Lab-only exclusion, or use an in-memory method — never disable AV on real hosts |
| wdigest Password shows (null) | WDigest caching disabled (default on modern Windows) | Expected & good — use the NTLM hash or ekeys instead of cleartext |
| 0x00000005 ACCESS_DENIED on sekurlsa | 32-bit mimikatz against 64-bit LSASS | Use the x64\mimikatz.exe build to match the target process |
| dcsync "RPC server unavailable" | Account lacks replication rights, or no route to a DC | Run as an account with DS-Replication rights; confirm DC connectivity |
12 — Sources & References
VERIFYStudy the offense to build the defense.
Mimikatz is not going away — its code is welded into modern ransomware toolchains. The defenders who stop it are the ones who have watched it run, know exactly which telemetry it lights up, and have already deployed RunAsPPL, Credential Guard and DCSync auditing. Run this lab, deploy the detections above, and validate them against your own SIEM.
⚠️ For authorised lab and defensive use only. Test exclusively on systems you own or are explicitly contracted to assess. CyberHawk Threat Intel publishes this content for defensive education and detection engineering.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."