Mimikatz: What It Does, What It Reveals and How to Detect It

Mimikatz is an open-source Windows tool that extracts credentials: it reads passwords, NTLM hashes and Kerberos tickets out of the memory of the Local Security Authority Subsystem Service (LSASS) process, and, given replication rights, copies every password hash in Active Directory from a domain controller. Testers use it to prove how far one compromised machine reaches, and attackers use it for the same reason: MITRE ATT&CK lists 52 threat groups that have used it as of ATT&CK version 20.1, checked in November 2026. If it ran in your network and worked, it is telling you where privileged credentials were exposed, which protections were missing, and whether anything noticed.

To find out which of your own hosts would give up privileged credentials, our Active Directory security assessment starts from one standard user and checks each host it reaches, at $6,000 for one domain of up to a few hundred hosts with a free retest (multi-domain estates are quoted). The internal network testing price guide shows how that compares with a full internal test.

What is Mimikatz?

French programmer Benjamin Delpy released Mimikatz in May 2011. When he reported the weakness behind it, Microsoft’s answer was that the attack required a machine that was already compromised (Wikipedia, citing Wired). Mimikatz is post-exploitation: it needs administrator or SYSTEM rights on the host it reads, or directory replication rights for its domain controller functions. When it appears, an attacker already has a foothold and wants the domain.

Its last tagged release, 2.2.0, is dated September 19, 2022, and was still the newest on the project’s releases page in November 2026. Endpoint products know the public build (Microsoft Defender calls it HackTool:Win32/Mimikatz), so real intrusions often use recompiled builds, in-memory loaders and PowerShell ports, or run it from inside a command and control framework such as Cobalt Strike. Or it never runs on the victim at all: the attacker copies LSASS memory to a dump file with a signed or built-in tool and parses it offline with Mimikatz or a Python port, so command-line and script-block rules stay silent. Detect what it does, not a file name.

MITRE’s list includes APT29, Volt Typhoon and Scattered Spider, and CISA’s LockBit advisory (AA23-165A) says LockBit affiliates used it to dump credentials, a routine step in how ransomware attacks work. Many alerts are friendly: Red Canary found that removing customer-reported testing cut Mimikatz from 7.2 percent of its customers to 3.1 percent, and judged its resulting fifth place among 2024 threats still inflated by testing nobody reported. Tag authorized tests so real activity is not waved off.

How Mimikatz works: the modules that matter

Windows keeps reusable credentials in LSASS so users can reach file shares and other services without retyping a password; Mimikatz reads them back out. Its functions are grouped into modules whose names show up in EDR alerts, command lines and test reports.

Module	What it does	ATT&CK	What success says
sekurlsa	Reads NTLM hashes, Kerberos tickets and keys, and any cached plaintext from LSASS; also runs pass-the-hash	T1003.001, T1550.002	Admin rights on a host where valuable accounts had signed in, with LSASS unprotected
lsadump	Reads the local SAM, LSA secrets and cached logons; poses as a domain controller to replicate hashes (DCSync)	T1003.002, T1003.004, T1003.005, T1003.006	Local admin on a host, or an account with replication rights
kerberos	Exports and injects tickets (pass-the-ticket); forges golden and silver tickets	T1550.003, T1558.001, T1558.002	Reusable tickets, or a krbtgt or service key already stolen, a service key often through Kerberoasting
dpapi, vault, crypto	Decrypts saved browser and Credential Manager passwords; exports certificates and keys marked non-exportable	T1555.003, T1555.004, T1552.004, T1649	Secrets on endpoints open to anyone with admin rights; an exported certificate is the starting point for AD CS certificate attacks
misc, sid, lsadump::dcshadow	Persistence: a password-recording security package, a skeleton key on a domain controller, a rogue domain controller, SID history injection	T1547.005, T1556.001, T1207, T1134.005	The domain was already compromised at Tier 0

sekurlsa::logonpasswords

The best-known function was also the most-used module in Red Canary’s 2024 data, and Red Canary most often sees Mimikatz run through its PowerShell port, Invoke-Mimikatz. It lists the credentials LSASS holds for the sessions on a machine: on an unprotected server, a reusable hash for each administrator with a session on it; with Credential Guard running, the hashes and ticket-granting tickets stay in an isolated process it cannot read. An NTLM hash is reusable as it is. The cached domain logons that lsadump reads are not: MITRE notes they do not allow pass-the-hash and have to be cracked offline with hashcat first, so a long passphrase still protects them.

What its use reveals about your environment

A Mimikatz finding is rarely a missing patch. It is a configuration or an administrative habit:

• Plaintext passwords. Windows 8.1, Server 2012 R2 and later do not cache WDigest credentials unless the UseLogonCredential registry value is set to 1 (Microsoft KB2871997), so plaintext usually means a legacy system or a value someone changed.
• A Domain Admin hash on a workstation or member server. A tiering failure: privileged accounts sign in where malware can reach them.
• One local administrator hash that opens many hosts. Windows LAPS is missing or patchy, and pass-the-hash does the rest; see our lateral movement guide.
• DCSync from an account that is not a domain controller. The two replication rights were granted too widely, often to a backup or migration account or through nested groups. Microsoft documents both rights for the Entra Connect connector account when password hash sync is on, so treat that account and its server as Tier 0.
• An accepted golden ticket. The krbtgt key is in someone else’s hands; our golden and silver ticket guide covers recovery.
• Everything worked and nothing alerted. A detection gap as serious as the exposure.

BloodHound maps where those sessions and rights sit; Mimikatz proves the credentials can be taken. Impacket and NetExec run several of the same techniques from Linux and Rubeus covers Kerberos. A dumped administrator hash is then used directly, for example to open a remote shell with Evil-WinRM. Each fix has a check in our Active Directory hardening checklist.

Does Mimikatz still work on Windows 11 and Server 2025?

Partly; the difference is configuration. Credential Guard protects NTLM hashes, ticket-granting tickets and stored domain credentials, and is on by default for qualifying domain-joined Windows 11 22H2+ and Windows Server 2025 machines. It is not licensed on Windows Pro, not recommended on domain controllers, and does not protect Kerberos service tickets, the SAM or the Active Directory database.

LSA protection stops non-protected processes reading LSASS. It is on by default only for new, enterprise-joined, HVCI-capable Windows 11 22H2+ installs; upgraded machines keep their old setting, and without the UEFI lock an admin can switch it off. Mimikatz ships its own kernel driver for removing that protection, so alert on new driver loads and keep memory integrity (HVCI) and Microsoft’s vulnerable driver blocklist, on by default since the Windows 11 2022 update, switched on.

No endpoint setting stops DCSync, which needs only an account holding the replication rights, or a golden ticket, which keeps working until the krbtgt password has been reset twice.

Mimikatz detection: what to log and what to alert on

Much of this telemetry is off by default. Deploy Sysmon with an lsass.exe process-access rule that filters your known tools (Microsoft warns it is noisy unfiltered), log command lines and PowerShell script blocks, and on domain controllers confirm Audit Directory Service Access is on with an audit entry on the domain root, since event 4662 is only written when one matches.

Activity	Log source	Event or signal	What it means
Reading LSASS memory	Sysmon, EDR, Defender ASR	Sysmon 10 targeting lsass.exe from an unexpected process; events from the ASR rule “Block credential stealing from the Windows local security authority subsystem”	Credential dumping
LSASS dump written to disk	Sysmon 11, 1 and 10, Security 4688	A .dmp file written by a process other than your crash-dump tooling, or rundll32 with comsvcs.dll, ProcDump or Task Manager opening lsass.exe	Credentials copied for offline parsing
Module names	Security 4688, Sysmon 1, PowerShell 4104	sekurlsa::, lsadump:: or kerberos:: on a command line, or Invoke-Mimikatz in a script block	Mimikatz or a port ran
WDigest switched on	Sysmon 13	UseLogonCredential set to 1	Plaintext wanted at next sign-in
New security package	Sysmon 13 and 7, Security 4622, CodeIntegrity 3066 and 3033	Change to the Lsa Security Packages value, or an unsigned DLL loading into lsass.exe (3066 in audit mode) or blocked by LSA protection (3033)	Password-recording persistence
Kernel driver	System 7045, Security 4697, Sysmon 6	New driver service on a workstation or server	Possible LSA protection bypass
Pass-the-hash	Host Security log, Defender for Identity	4624 logon type 9 then network logons elsewhere; “Suspected identity theft (pass-the-hash)”	A stolen hash in use
Overpass-the-hash	DC Security log, Defender for Identity	4768 using RC4 from a client that normally uses AES (an attacker with the AES key avoids this), or a TGT request for an account from a host where it never signs in; “Suspected overpass-the-hash attack (Kerberos)”	A hash turned into a ticket
DCSync	DC Security log, Defender for Identity	4662 on the domain object citing 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 or 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 by a non-DC account; “Suspected DCSync attack (replication of directory services)”	Hashes copied out of AD
Golden ticket	DC Security log, Defender for Identity	4769 for an account with no earlier 4768 or 4770 (renewal) on any domain controller; “Suspected Golden Ticket usage” alerts	A forged ticket in use
DCShadow, skeleton key	Defender for Identity	“Suspected DCShadow attack”, “Suspected skeleton key attack (encryption downgrade)”	Tier 0 persistence

The GUIDs are Replicating Directory Changes and Replicating Directory Changes All. Exclude domain controllers and the Entra Connect connector from the DCSync rule, and alert if that connector replicates from any other host. Legitimate network-only “run as” also produces logon type 9, so baseline it per host. Then prove the rules fire, which is what a purple team assessment is for.

What to do when Mimikatz is detected

An alert for Mimikatz or for LSASS access means someone already had administrator rights on that host. Work in this order:

1. Rule out a test, quickly. Check the alert against the source hosts and time window of any authorized test and ask its named contact. If nobody claims it, treat it as real.
2. Contain the host without powering it off. Use your EDR’s network isolation so memory, the dump file and the logs survive for investigation.
3. List every account with a session on that host. Pull the 4624 logons and EDR session data since the last reboot. Treat each of those credentials as stolen, service accounts included.
4. Reset them, most privileged first. Rotate the local administrator password through LAPS as well. A password reset does not cancel Kerberos tickets already issued, so sign the accounts out or restart the systems they were used on.
5. Hunt for reuse. From the time of the first LSASS access, search for the pass-the-hash, overpass-the-hash and DCSync signals in the table above.
6. Escalate if Tier 0 was touched. If the host was a domain controller, held a Domain Admin session, or DCSync fired, assume every hash in the domain was copied: plan the double krbtgt reset and a domain-wide password reset, and look for the persistence signals above (new security packages, new drivers).
7. Find how admin rights were obtained. The dump is the middle of the intrusion, not the start. Close the route that led to it before you reconnect the host.

How to prevent Mimikatz attacks

Control	What it stops	Default	How to check
Credential Guard	Theft of hashes, TGTs and stored domain credentials from LSASS	On for qualifying domain-joined Windows 11 22H2+ Enterprise or Education and Server 2025; not Pro or DCs	Credential Guard listed under Virtualization-based security Services Running in System Information, or WinInit event 13 (Credential Guard started) in the System log, on sampled hosts
LSA protection, with UEFI lock	LSASS reads and unsigned packages	On without the lock for new enterprise-joined, HVCI-capable Windows 11 22H2+ installs only; the lock must be set by policy	WinInit event 12: LSASS started as a protected process
WDigest caching off	Plaintext in memory	Off since Windows 8.1 and Server 2012 R2	UseLogonCredential absent or 0
Protected Users for human admins	Cached hashes and plaintext, NTLM, RC4, delegation; four-hour TGTs	Empty	Review members; never add service or computer accounts
Tiering, plus Restricted Admin or Remote Credential Guard for RDP	Admin credentials landing on attacker-controlled hosts	Not configured	Domain Admin sessions on non-Tier 0 hosts
Windows LAPS	One local hash opening every host	Must be deployed	Machines without a managed password
Replication rights limited to DCs and Tier 0 groups	DCSync	Held by Administrators, Domain Admins, Enterprise Admins	Domain root permissions
krbtgt reset twice	Golden tickets	Manual	krbtgt password-last-set
Group managed service accounts for services	Long-lived service passwords set by hand and reused after theft; Windows manages and changes the password	Must be deployed	Services still running as ordinary user accounts
Authentication policies and silos for Tier 0 and service accounts	Privileged accounts obtaining tickets from hosts outside their tier	Not configured; a new silo only audits until enforced	Silo members, and whether each policy is enforced

Because krbtgt keeps its two most recent passwords, only two resets, at least the maximum ticket lifetime apart, kill a forged TGT; our golden ticket guide covers the procedure and the detections. Where LSA protection cannot run, for example because of a legacy smart card driver, Microsoft positions the ASR rule above as equivalent protection on machines running Microsoft Defender Antivirus.

How Invadel tests for it, and what it costs

Credential exposure is part of every Active Directory security assessment. From one standard domain user, a senior tester follows the paths to local admin, then checks what each host gives up: whether Credential Guard and LSA protection really run, whether WDigest is back on, where privileged accounts have sessions, and who holds replication rights. With no changes made to domain controllers, DCShadow, skeleton key and SID history are reported from the rights that allow them, not run, and forged tickets are used only if you put them in scope.

For each host that gave up credentials, the report names the accounts exposed, the protection that was missing and the Sysmon, 4662 or Defender for Identity signal that should have fired, mapped to MITRE ATT&CK. If grading what your monitoring caught is the goal, that is what the ransomware readiness assessment, red team and purple team assessment add.

Engagement	What it shows about credential theft	From
Active Directory security assessment	Which hosts hand privileged hashes or tickets to an admin-level attacker, and who holds replication rights	$6,000
Internal network penetration test	The same across every host type in scope, and where each stolen hash works next	$6,000 Small, $9,200 Medium, $14,500+ Large
Ransomware readiness assessment	Whether credentials taken this way reach Domain Admin and then the backups	$6,000
Red team	Whether your SOC catches LSASS access, DCSync or pass-the-hash during a covert operation	$12,500

The free retest checks the same hosts once the protections are on. Send the scoping questionnaire for a written fixed price, with no sales call; executive and technical reports and an attestation letter are included, and onboarding starts within 24 hours of a signed proposal. The sample report shows the format, and our pricing page lists every service.

Frequently asked questions

Is Mimikatz malware? No. It is an open-source security testing tool that Microsoft Defender classifies as a hack tool, but dozens of threat groups use it, so treat any unexplained Mimikatz alert as an incident.

What does sekurlsa::logonpasswords do? It lists the credentials LSASS holds for sessions on a machine: NTLM hashes and, where WDigest or another provider still caches them, plaintext passwords. Kerberos tickets and keys come from other functions in the same module. It needs admin or SYSTEM rights, and Credential Guard keeps NTLM hashes and ticket-granting tickets out of its reach.

Does Mimikatz need administrator rights? To read LSASS or the SAM, yes: local administrator or SYSTEM. Some functions need no admin rights, such as handling the current user’s own tickets or forging one with a stolen key, and DCSync needs no admin rights on any host, only network reach to a domain controller and an account holding both replication rights.

Does Credential Guard stop Mimikatz? It stops theft of NTLM hashes and ticket-granting tickets from LSASS on protected machines, though Microsoft notes that Kerberos service tickets are not protected. It does not cover the SAM, the Active Directory database or domain controllers, and does nothing against DCSync or a golden ticket. An attacker with admin rights can still capture passwords typed at later sign-ins, for example with a password-recording security package, so it raises the cost rather than ending the risk.

What should we do first if EDR flags Mimikatz? Confirm within minutes whether it is an authorized test. If not, isolate the host from the network without powering it off, list every account that had a session on it and reset those credentials, most privileged first. The full order is in the response steps above.

Does Mimikatz work against cloud-only Entra ID accounts? Not in the same way. A cloud-only account has no password hash in on-premises Active Directory, so DCSync and golden tickets do not apply to it. On an Entra joined device the valuable credential is the Primary Refresh Token that gives the signed-in user single sign-on, and Microsoft’s documentation says it is bound to the device, with its keys protected by the TPM where one is working. Hybrid accounts synced from Active Directory are exposed on both sides.

What is the difference between Mimikatz and pypykatz? pypykatz is a Mimikatz implementation in pure Python that runs on any operating system with Python and parses LSASS dump files offline. For a defender the difference is where it runs: nothing named Mimikatz executes on the victim, so the dump being created is the event to detect.

How much does it cost to test our domain against Mimikatz-style attacks? Credential exposure is checked on every host we reach in an Active Directory security assessment, from $6,000 for one domain; whether your SOC would catch the theft is a red team question, from $12,500. Both prices are fixed in writing with a free retest.

The short version

Mimikatz takes credentials from LSASS and copies hashes out of Active Directory, and every success points at a fixable cause: unprotected LSASS, WDigest, admins signing in where they should not, shared local passwords or loose replication rights. Detect it with Sysmon 10, 4662 and Defender for Identity; stop it with Credential Guard, LSA protection, Protected Users, LAPS and tiering. See what our Active Directory assessment covers, check the internal network testing prices, or scope your test.