mimikatz
2.2.0-20210723 open-sourceThe section your link pointed to isn't on mimikatz's page any more, so we've brought you to the top.
mimikatz is a Windows security tool that extracts plaintext passwords, hashes, PIN codes, and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. tickets from memory.
mimikatz # misc::efs
Summary
mimikatz is an open-source, free command-line tool for Windows that pulls plaintext passwords, hashes, PIN codes, and Kerberos tickets out of memory, and can then reuse them via pass-the-hash, pass-the-ticket, or forged Golden Tickets. It runs interactively as its own shell, with commands grouped into modules covering LSALSALocal Security Authority — a Windows subsystem that handles authentication, enforces local security policy, and stores credential material, making it a frequent target for credential-harvesting cyber tools. secrets, vault credentials, certificate stores, and Kerberos operations like DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers.. It is built for red teamers and penetration testers who need to demonstrate credential theft and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. inside a Windows domain, rather than for defenders running it directly, though SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts study its output to detect misuse. The category is post-exploitation credential dumping, alongside the broader set of Windows lateral-movement techniques it made mainstream. Started in 2014 as its author's project to learn C, it now has 13 contributors, though activity has slowed to just a handful of commits and one release in the past year.
mimikatz is a Windows security tool that extracts plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory.
How mimikatz helps
Which credentials are actually sitting in memory on this machine right now?
reads logon session data out of the LSA process and lists usernames, domains, and recoverable plaintext passwords or hashes for every session, not just the current user
Can someone move laterally to another machine without ever knowing its password?
takes a captured hash and injects it into a new session, letting that session authenticate as the owning account without the plaintext ever being known
Would a stolen Kerberos ticket let an attacker impersonate this user elsewhere?
exports the tickets held by current logon sessions and can inject a saved ticket into another session, showing whether the domain accepts it as valid
Is the domain's krbtgt account a single point of total compromise?
forges a Kerberos ticket from the krbtgt hash and domain SID, producing credentials the domain will honor for a chosen identity independent of any real account's password
Are locally cached credentials or saved vault entries exposing more than intended?
reads the SAM database, cached domain logons, and the Windows vault store, showing which secrets survive a reboot or logoff and where they're kept
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for mimikatz, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail mimikatz puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
2 entries
No entries match these filters.
- July 20212
Project health
Issue, contributor and maintainer activity in gentilkiwi/mimikatz, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 3 +2 vs prior 12 months
- Maintainers 1 +1 joined · −0 left, last 12 months
- Bus factor 1 committers behind half the commits
- Community-filed 100% of issues opened, last 12 months
- Median time to close not measured issues closed, last 12 months
- Open backlog 155 of 401 issues ever filed
- Issues opened / month 1 · 0 communitymaintainers
- Open backlog 155
- Contributors / month 0
- Commits / month 0
- Stars 21,843
- other 100%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Articles
43 articles · updated Nov 4, 2026Where mimikatz turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.
-
MimiKatz for Pentester: Kerberos
In this article, we will explore how to use Mimikatz for extracting Kerberos tickets, generating Golden Tickets, and performing Pass the Ticket attacks.
2 more quotes
Whether you’re a cybersecurity enthusiast or a seasoned pentester, this guide will provide valuable insights into leveraging Mimikatz for advanced Kerberos exploitation techniques.
This write-up will be part of a series of articles on the tool called Mimikatz which was created in the programming language C.
-
Metasploit for Pentester: Mimikatz
This article will showcase various attacks and tasks that an attacker can perform on a compromised Windows Machine that is part of a Domain Controller through Metasploit’s inbuilt Mimikatz Module, also known as kiwi.
2 more quotes
We covered various forms of Credential Dumping with Mimikatz in our Series but we didn’t present a consolidated guide to use Mimikatz with Metasploit.
Also, after the response from the PowerShell Empire for Pentester: Mimikatz Module , We were encouraged to create this resource.
-
PowerShell Empire for Pentester: Mimikatz
This article will showcase various attacks and tasks that can be performed on a compromised Windows Machine which is a part of a Domain Controller through PowerShell Empire inbuilt Mimikatz Module.
2 more quotes
Any other tool that we could remember that has more utility than anything is the Mimikatz.
We know that neither PowerShell Empire nor Mimikatz is being used in the wild currently because of their signature that has been added to almost all of the Anti-Virus Software and across Virus Total.
-
Understanding Guide to Mimikatz
What is Mimikatz?
2 more quotes
Mimikatz is a Tool made in C Language by Benjamin Delpy .
You can get Mimikatz In ZIP from here .
-
Hack Windows Password in Clear Text using Mimikatz and Windows Credentials Editor
Mimikatz mimikatz is a tool to check Windows security.
2 more quotes
mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets .
First Download mimikatz windows version from here .
-
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
…DeepSeek model, and publicly available offensive security tools (e.g., Mimikatz, SharpHound, Certipy, Rubeus, and Impacket) to compromise no less than 440 instances of PaperCut MF/NG hosted by 395 identified victim…
-
AI-powered attack exploited PaperCut flaws to hack 395 organizations
The attacker’s toolkit includes Ligolo-ng, Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, and custom Rust credential-collection utilities.
-
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw
"In this new activity, Storm-1175's post-compromise behavior includes abuse of remote monitoring and management tools AnyDesk or SimpleHelp, Advanced IP Scanner for discovery, and LSASS dumping using Mimikatz," it added.
-
New StormEncryptor ransomware used by former Medusa affiliate
…the attacker used AnyDesk or SimpleHelp for remote management, Advanced IP Scanner for network discovery, and the Mimikatz tool to dump credentials from the Local Security Authority Subsystem Service (LSASS) process.
-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry
…reached domain-admin or full-network control in several environments through stolen backup keys, mimikatz paired with a Godzilla webshell, FortiGate VPN compromise, and Pass-the-Hash combined with DPAPI cookie theft.
Show all 16
-
GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses
…covering the full breadth of credential storage on a Windows host: Mimikatz (mimik.exe), WebBrowserPassView, ChromePass, PasswordFox, MessengerPass, VNCPassView, MailPassView, SniffPass, OperaPassView,…
1 more quote
…of a password protected self-extracting archive containing the Mimikatz credential-dumping tool and a large number of password-harvesting tools developed by NirSoft, much like the tools we saw used in this…
-
'GodDamn' Ransomware Uses BYOVD to Smite US Companies
All but one of those programs, Mimikatz , came from NirSoft, a free website for Windows utilities.
-
GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration
The backdoor is capable of deploying additional malicious tools, including ThumbcacheService for file collection, Mimikatz for credential dumping, and QuarksDumpLocalHash for local account password hash extraction.
1 more quote
…The threat actor deploys the following tools via GoSerpent backdoor to dump credentials: Mimikatz — dumps memory from the LSASS process to extract credential material, including cached credentials and Kerberos tickets.
-
Toy Ghouls’ new toy: the GenieLocker ransomware
Discovery and Credential Access After breaching the target’s network, the attackers installed additional tools on the compromised hosts, including OpenSSH, socks5.exe, SoftPerfect Network Scanner, and Mimikatz.
1 more quote
They employed SoftPerfect Network Scanner for discovery and used Mimikatz to dump credentials.
-
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
For credential access and harvesting, Storm-2570 uses tools like Mimikatz, LaZagne, and pypykatz.
-
CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress
Dump credentials with Mimikatz , run from anomalous directories (e.g., C:\Binaries ) The objective: Dragonforce ransomware In the most progressed case we worked, the operator reached the goal line.
-
Defence Impairment Olympics
In this incident we observed the threat actor dismantling defences before dumping credentials using a Mimikatz driver, which would have otherwise triggered critical defender alerts.
-
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
While they frequently use common open-source tools such as SoftEther VPN, Mimikatz and VNT, they have recently introduced TinyRCT, a bespoke, previously undocumented backdoor.
1 more quote
Related Unit 42 Topics CL-STA-1062, Malware , Backdoor , VPN, Mimikatz Latest Campaign Analysis While this article focuses on CL-STA-1062 activity against targets in Southeast Asia during 2025, our telemetry reveals…
-
DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy
Mimikatz output recovered from memory on one of the compromised endpoints showed access to credential material, including domain accounts and stored credentials from Credential Manager.
2 more quotes
Credential Access Credentials from Password Stores ( T1555 ) Mimikatz dumping likely includes passwords from Windows Credential Manager/password stores, used later for --spread and PsExec.
…Credential Access OS Credential Dumping ( T1003 ) Mimikatz artefacts recovered from memory show dumping of domain credentials and stored secrets from compromised workstations.
Show all 20
-
Containing a domain compromise: How predictive shielding shut down lateral movement
The attacker also deployed Mimikatz to dump logon secrets (for example, MSV, LSASS, and SAM), harvesting credentials that are exposed on the device.
1 more quote
Credential Access T1003.001 OS Credential Dumping: LSASS Memory Dumped LSASS using Mimikatz and comsvcs.dll MiniDump .
-
Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations
Credential theft Impacket is further used to facilitate credential dumping through LSASS; the threat actor also leveraged the commodity credential theft tool Mimikatz in identified intrusions in 2025.
-
Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia
Getpass, a Custom Modified Mimikatz Variant In addition to the two backdoors, our analysis revealed a custom credential-harvesting tool.
2 more quotes
Getpass is a custom version of Mimikatz , packaged as a standalone DLL that attempts to masquerade as a legitimate Palo Alto Networks tool under the Cyvera directory, as Figure 8 shows.
Unlike standard Mimikatz, which provides an interactive console, this variant automatically runs its credential-harvesting routine and logs the stolen data to a file named WinSAT.db , which masquerades as a legitimate…
-
An Investigation Into Years of Undetected Operations Targeting High-Value Sectors
Mimikatz and LsaRecorder The attackers used Mimikatz to dump passwords from memory, and a dumping tool named LsaRecorder, as Figure 8 shows.
-
Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?
…tools that have previously been misused in attacks include dual-use penetration testing frameworks, such as Cobalt Strike, Mimikatz, Metasploit, and PowerSploit, as highlighted in the Huntress 2025 Cyber Threat Report .
-
Threat Group Assessment: Muddled Libra (Updated May 16, 2025)
Standard credential-stealing tools employed in this phase included Mimikatz, ProcDump, DCSync, Raccoon Stealer and LAPS Toolkit.
-
Intelligence Insights: February 2022
Mimikatz retains its position as the most prevalent threat for the third time in the last four months.
2 more quotes
Following Mimikatz is Impacket, another common tool used by adversaries and red teams alike.
Mimikatz ascends the threat ranks, Emotet increases phishing campaigns, and the new Coral Crane activity cluster emerges.
-
Mining off the Land: Cryptomining Enabled by Native Windows Tools
These behaviors closely mimic what we observe when adversaries use Mimikatz to steal or abuse password hashes.
2 more quotes
When pieced together in this context, we hypothesized that a tool like Mimikatz had been loaded into PowerShell to gather legitimate credentials, which were then used to authenticate to other endpoints and spread a…
…Atomic Red Team tests to see if your existing controls can detect them: Regsvr32.exe Scheduled Task PowerShell WMI Event Subscription Persistence Credential Dumping (Think Mimikatz) What About Prevention Tactics?
-
Behind the Scenes of an Active Breach (Part 2): Evading Defenses
The screenshot below shows a 001.ps1 file being downloaded from an external site and was likely a PowerShell implementation of Mimikatz, a tool often used to extract password hashes and Kerberos tickets from memory.
-
AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
A Golden Ticket's validity is set by the attacker at forgery time, and Mimikatz defaults to 10 years because that is a round number that fits the Kerberos lifetime field.
-
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
…We attempt to extract a well-known driver universally classified as malicious ( mimidrv.sys – part of the Mimikatz post-exploitation tool) and modify Defender registry keys using standard Administrator privileges.
Libraries its release ships
What its latest release locks, checked against known advisories.None of its release's images build from a lockfile we can read.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →