Mimikatz.

An open-source Windows post-exploitation tool that extracts plaintext passwords, hashes, Kerberos tickets, and other credentials from memory and LSASS. It belongs to the Defense & Operations category of cybersecurity.

An open-source Windows post-exploitation tool that extracts plaintext passwords, hashes, Kerberos tickets, and other credentials from memory and LSASS.

Mimikatz is a credential-access tool created by Benjamin Delpy (gentilkiwi) to demonstrate fundamental Windows authentication weaknesses, particularly in LSASS memory and the SSPI providers (WDigest, Tspkg, Kerberos, MSV). It can dump credentials, forge Kerberos Golden and Silver tickets, perform pass-the-hash and pass-the-ticket, and manipulate certificates. While originally a research project, it became a staple of red-team toolkits and is heavily abused by ransomware actors after initial domain access. Modern Windows defenses (Credential Guard, LSA Protection, EDR, restricted admin mode, tiered administration) significantly reduce its impact, but it remains an essential benchmark for detection engineering.

Defences for Mimikatz typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: mimi, kekeo, Invoke-Mimikatz.