Definition: Mimikatz is a well-known and feared security tool. Benjamin Delpy first wrote it. It is mainly used to pull login data, such as passwords and Kerberos tickets, out of the memory of a Windows system.
What is Mimikatz?
Mimikatz was built mainly as a tool for security checks and penetration tests. But today it is also one of the tools criminals like best for their attacks.
Features and capabilities of Mimikatz
Mimikatz has many features. Both security experts and attackers use them to exploit weak spots in a Windows system:
- Password theft: Mimikatz can read passwords that sit in memory in plain text. It can also read password hashes.
- Kerberos ticket theft: It can steal and fake Kerberos tickets. With them, attackers get into networks without permission.
- Golden Ticket: With the password hash of the KRBTGT account, Mimikatz can create so-called Golden Tickets. These give broad access to the whole domain.
- LSASS dumping: Mimikatz reads the LSASS process to get at sensitive data.
Typical attack scenarios involving Mimikatz
Attackers often use Mimikatz in different stages of an attack:
- First access: The attacker gets into a system through phishing or an exploit.
- Stealing login data: Mimikatz pulls passwords and Kerberos tickets from the hacked system.
- Lateral movement: With the stolen login data, the attacker moves sideways through the network.
- Lasting admin access: The attacker creates Golden Tickets to keep access for a long time and stay hidden.
Protective measures against Mimikatz
Use several layers of protection so that Mimikatz has as little effect as possible:
- Security awareness: Train your staff to spot and report phishing.
- Hardening LSASS: Run LSASS as a protected process (LSA protection). Use Credential Guard where you can.
- Regular security updates: Keep systems and software up to date. That closes gaps Mimikatz could use.
- Use of Endpoint Detection & Response (EDR): Use tools that spot unusual activity and react to it.
- Network segmentation: Split your network into zones. That makes lateral movement harder.
Further hardening measures for Windows and Active Directory
- Limit local admin rights: Many Mimikatz functions need admin rights. So normal users should not be local admins.
- Use a different local admin password on each system: Tools such as Windows LAPS make sure a stolen password does not work on many systems.
- Protect privileged accounts: Let domain admins sign in only on set, hardened systems. Use the Protected Users group.
- Keep WDigest turned off: Then passwords are not kept in plain text in memory.
- After an incident: If you suspect Golden Tickets, reset the password of the KRBTGT account twice.
Conclusion
Mimikatz is a powerful tool. It gives pentesters useful insights. At the same time, it is a serious threat for IT security teams. To protect your network, you need to know how it works. You also need the right protective measures in place.
🔒 Have your systems tested for weak spots against Mimikatz: contact us now.
📌 Related topics: Kerberos attacks, Pass-the-Hash