Mimikatz.

Mimikatz is a credential-access tool created by Benjamin Delpy (gentilkiwi) to demonstrate fundamental Windows authentication weaknesses, particularly in LSASS memory and the SSPI providers (WDigest, Tspkg, Kerberos, MSV). Its most famous discovery was that the WDigest provider cached logon passwords in cleartext by default until Microsoft shipped KB2871997 and the UseLogonCredential registry hardening for Windows 8.1/Server 2012 R2. The sekurlsa::logonpasswords command reads secrets directly from LSASS; lsadump::dcsync abuses the MS-DRSR replication protocol (DRSUAPI) to pull any account's hash from a domain controller without running code on it (MITRE ATT&CK T1003.006), and kerberos::golden forges a krbtgt-signed TGT for near-permanent domain persistence.

Its techniques are woven into major incidents: the 2017 NotPetya wiper bundled a Mimikatz-derived credential harvester that piped stolen secrets to the worm over a named pipe, letting it move laterally to already-patched hosts alongside EternalBlue (CVE-2017-0144). Modern defenses — Credential Guard (VBS-isolated LSASS), LSA Protection (RunAsPPL), tiered administration, and EDR — significantly reduce its impact. Detection engineers watch for suspicious LSASS handle access (Sysmon Event ID 10, T1003.001).

flowchart LR
  A[Compromised host<br/>local admin] --> B[LSASS process memory]
  B --> C{Mimikatz module}
  C -->|sekurlsa::logonpasswords| D[Plaintext / NTLM hashes]
  C -->|lsadump::dcsync| E[krbtgt hash via DRSUAPI]
  C -->|kerberos::golden| F[Forged Golden Ticket]
  D --> G[Pass-the-Hash / lateral movement]
  E --> F
  F --> H[Domain-wide persistence]