How does mimikatz work

Stealthbits Privileged Activity Manager. Stealthbits Activity Monitor. Netwrix and Stealthbits merge to better secure sensitive data. Already a partner? Visit the partner portal or register a deal below! Stealing Credentials with Mimikatz Mimikatz is an open-source tool built to gather and exploit Windows credentials. What Exactly Does Mimikatz Do? Stealing Credentials Mimikatz has a variety of ways that it can steal credentials from a system.

Lateral Movement Stealing credentials is the first step, the next step is to use them. Persistence Once an attacker has successfully moved laterally to compromise a target domain, Mimikatz offers several ways to make sure they maintain their control even after detection. How Do Attackers Use Mimikatz? Jeff Warren. Previous Next. Featured Asset. A Practitioner's Guide to Active Directory Learn why Active Directory security should be a priority for your organization and ways to mitigate against a data breach with this free white paper!

Despite being developed over 12 years ago, the toolset continues to work and improve, and likewise, mimikatz continues to provide a challenge to ageing and legacy endpoint protection technologies. Get A Demo. What is Mimikatz? Back to Glossary. Introduction What if we were to tell you that there was a magical tool that could greatly simplify the discovery and pillaging of credentials from Windows-based hosts? This includes tickets, pin codes, keys, and passwords. Standard main module of the tool.

Watch Now. Schedule A Demo. Your most sensitive data lives on the endpoint and in the cloud. Protect what matters most from cyberattacks. Fortify every edge of the network with realtime autonomous protection. Get a demo. In reality, however, the Windows authentication software still was a useful tool for hackers looking to spread their malware from one computer to multiple devices on a network. If a malicious piece of software gained administrator rights, it could steal the encrypted password from memory, as well as the key to decrypt it and use them to gain access to other components inside the environment.

Delpy soon noticed Chinese users debating the use of Mimikatz and attempting to reverse-engineer it on hacker forums. And, in mid, he heard for the first time that Mimikatz had been used in a government network infiltration. In September of that year, the tool was used in the historic hack of DigiNotar , one of the certificate authorities that ensures websites using HTTPS are who they appear to be.

According to cybersecurity experts at Fox-IT, the intrusion enabled the anonymous attackers to issue fake certificates, which were then used to eavesdrop on thousands of Iranians. Web browsers blacklisted DigiNotar, and the company went out of business as a result. By Windows 10, the exploitable feature would be disabled by default. However, to this day, Mimikatz is still successful on nearly any Windows machine, either because the targeted device is running an old version of the operating system or because the attacker can perform privilege escalation in Windows systems and activate WDigest, even though it was initially disabled.

Despite these assaults, Delpy has not backed away from Mimikatz. Instead, he has continued to refine the tool, openly talking about it and introducing additional functionality so it remains compatible with the latest Windows version and includes the most recent attacks. Delpy now notifies Microsoft months in advance before introducing a feature that exploits a serious new security flaw in Windows. Nonetheless, it is a highly powerful tool that can be leveraged both for nefarious and ethical purposes.

Although cyber criminals use Mimikatz in credential stealing and privilege escalation attacks, a powerful EDR software will successfully eliminate it. Pentesters also use Mimikatz to find and exploit security flaws in networks so they can be addressed. Mimikatz is a program that was designed for good, but like many hacker exploits, it became commonly used for evil. It all started in with a man named Benjamin Delpy, a French programmer and IT manager by trade who discovered a security flaw in the inner workings of Windows operating systems and how they handle password data.

Delpy knew that in such situations where an attacker was able to exploit this security flaw, it could allow them to expand their access to other systems and compromise an entire network of computers, rather than just one individual machine. Delpy made the information public so Microsoft and other security professionals could work toward a solution, but he kept the source code of his project closed.

Unfortunately, those same bad guys caught on to Mimikatz and began working hard to gain access to the source code, attempting to reverse-engineer, recreate, and even steal the code directly from Delpy. After a few too many run-ins with men in suits demanding he hand over the program, Delpy released Mimikatz publicly for his own safety.

And thus began the rise of one of the most damaging and widespread hacker tools in the last decade. Mimikatz has been used as a component in many high-profile cyberattacks, including NotPetya , BadRabbit , attacks on government networks, and more.