Definition: Mimikatz is a freely available tool developed by Benjamin Delpy. It reads credentials such as passwords, password hashes and Kerberos tickets from the memory of Windows. Pentesters use it to show weaknesses. Attackers use it to spread further through a network.
What is Mimikatz?
Windows keeps credentials in memory so that users do not have to log in again and again. The process in charge is LSASS. That is exactly where Mimikatz attacks. Read more about the process under Hacking LSASS.exe.
Mimikatz started as a tool to show weaknesses in Windows. Today it is standard in penetration tests. But it is also one of the most popular tools among attackers. It became widely known, among other things, through the NotPetya malware, which used it to read credentials.
What Can Mimikatz Do?
- Read credentials: Mimikatz reads password hashes from LSASS memory. If passwords are stored there in plain text, it reads those too.
- Pass-the-hash: The attacker logs in with the hash without knowing the password. See pass-the-hash.
- Pass-the-ticket: Stolen Kerberos tickets are reused on other systems.
- Golden ticket: With the hash of the KRBTGT account, the attacker creates their own tickets. They grant broad access across the whole domain.
- Silver ticket: Forged tickets for single services, such as a file server.
- DCSync: Mimikatz poses as a domain controller and requests password hashes from Active Directory. This needs certain replication rights.
For many features, Mimikatz needs admin rights or the debug privilege on the system.
How an Attack with Mimikatz Works
- First access: The attacker gets onto a computer, for example through phishing or a vulnerability.
- Raise privileges: They gain local admin rights. See privilege escalation.
- Steal credentials: With Mimikatz, they read the hashes and tickets of all users who were logged in on the computer.
- Move sideways: With this data, they log in to more systems. The goal is an account with domain admin rights.
- Stay for good: With a golden ticket, they secure long-term access to the domain.
A single admin who logs in on an infected workstation can put the whole domain at risk this way.
Protection Against Mimikatz
Harden LSASS
- Turn on LSA protection: LSASS then runs as a protected process. Other programs can no longer simply read its memory. The feature is available from Windows 8.1 and Windows Server 2012 R2. On new installs of Windows 11 from 22H2, it is on by default.
- Use Credential Guard: Windows moves NTLM hashes and Kerberos tickets into an isolated, virtualized area. Microsoft explicitly names pass-the-hash and pass-the-ticket as attacks this makes harder. Credential Guard requires Windows Enterprise or Education and suitable hardware. Microsoft does not recommend it on domain controllers.
- Keep WDigest off: This way, passwords are not kept in plain text in memory.
Credential Guard does not protect everything. It does not cover local accounts, the SAM database or the Active Directory database itself.
Limit Rights
- Remove local admin rights: Normal users do not need admin rights. Only those who really need it should have the debug privilege.
- Unique local admin passwords: With Windows LAPS, a stolen password does not work on many systems at once.
- Separate admins: Domain admins only log in on dedicated, hardened systems. The "Protected Users" group adds extra protection for privileged accounts.
- Segment the network: Segments make it harder to move sideways through the network.
Detecting Mimikatz
- Watch access to LSASS: Unusual programs that try to read LSASS memory are a clear warning sign.
- LSA protection in audit mode: Windows then logs programs that try to load into LSASS in events 3065 and 3066. This shows you what would be blocked before you turn it on.
- Odd Kerberos activity: Tickets with an unusually long lifetime or logins from unexpected systems point to golden tickets or pass-the-ticket.
- Use EDR: Endpoint detection and response solutions spot typical attack patterns on devices.
What to Do After Finding Mimikatz
- Disconnect affected systems from the network and secure evidence.
- Assume that all credentials on the system were stolen.
- Reset the passwords of the affected accounts and of all privileged accounts.
- If you suspect golden tickets, reset the password of the KRBTGT account twice.
- Start your incident response plan and find out how the attacker got in.
Mimikatz in Penetration Testing
A pentest shows how far an attacker with tools like Mimikatz would get in your network. In the SecTepe penetration test, Active Directory can be part of the scope. We also test whether an attacker can gain more rights.
Conclusion
Mimikatz exploits the fact that Windows keeps credentials in memory. You cannot fully prevent that. But LSA protection, Credential Guard, few admin rights and separate admin accounts take away most of the tool's impact.
FAQ about Mimikatz
Is Mimikatz a virus?
No. Mimikatz is a freely available tool and does not spread on its own. Antivirus software still usually flags it as dangerous, because attackers use it so often.
Is using Mimikatz legal?
Only use Mimikatz on your own systems or with written permission, for example in a commissioned penetration test. Using it on other people's systems without permission is an attack.
Does Mimikatz work on Windows 11?
In principle, yes. But Windows 11 makes the attack much harder. On new installs from version 22H2, LSA protection is on by default. On suitable domain-joined devices running Windows 11 Enterprise or Education, the same applies to Credential Guard.
Does antivirus detect Mimikatz?
Known versions, mostly yes. But attackers modify the tool or only load it into memory. So do not rely on antivirus alone. Harden LSASS and watch for access to it.
What should you do if Mimikatz is found on the network?
Assume that credentials were stolen. Isolate affected systems, reset the passwords of privileged accounts and start your incident response plan. If you suspect golden tickets, reset the password of the KRBTGT account twice.