Skip to main content 首页 创作者 abelrguezr hacktricks-skills mimikatz-security-analysis
mimikatz-security-analysis Analyze and understand Mimikatz credential theft techniques for authorized security assessments, penetration testing, and defensive security research. Use this skill when you need to understand Windows credential extraction methods, Kerberos ticket attacks, LSASS memory analysis, or Active Directory attack vectors for security auditing, red teaming, or incident response. Make sure to use this skill whenever the user mentions Mimikatz, credential dumping, Kerberos attacks, LSASS analysis, Windows security assessment, or penetration testing involving Windows systems.
跳到安装 Skills Marketplace 发现并探索由社区构建的 Agent Skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/abelrguezr/hacktricks-skills --skill mimikatz-security-analysis命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
下载 Zip 下载中... 同仓库更多 Skills AI-assisted fuzzing and vulnerability discovery. Use this skill whenever the user wants to generate fuzzing seeds, evolve grammars, analyze crashes, create proof-of-vulnerability exploits, or generate patches for discovered bugs. Trigger on mentions of fuzzing, AFL++, libFuzzer, vulnerability discovery, crash analysis, exploit generation, or security testing with LLMs.
Set up and use Burp Suite's MCP Server extension to enable LLM-assisted passive vulnerability discovery. Use this skill whenever the user wants to integrate Burp with MCP-capable AI tools (Codex, Gemini, Ollama, Claude), configure the MCP proxy, troubleshoot handshake issues, or analyze intercepted HTTP traffic for security findings. Trigger on mentions of Burp MCP, Burp AI Agent, MCP proxy setup, or LLM-assisted traffic review.
Help users understand and implement deep learning concepts including neural networks, CNNs, RNNs, LLMs, and diffusion models. Use this skill whenever the user asks about deep learning architectures, wants to build neural networks in PyTorch, needs help with training loops, or wants to understand concepts like backpropagation, activation functions, attention mechanisms, or generative models. Make sure to use this skill for any deep learning related questions, code reviews, architecture design, or implementation help.
name mimikatz-security-analysis description Analyze and understand Mimikatz credential theft techniques for authorized security assessments, penetration testing, and defensive security research. Use this skill when you need to understand Windows credential extraction methods, Kerberos ticket attacks, LSASS memory analysis, or Active Directory attack vectors for security auditing, red teaming, or incident response. Make sure to use this skill whenever the user mentions Mimikatz, credential dumping, Kerberos attacks, LSASS analysis, Windows security assessment, or penetration testing involving Windows systems.
Mimikatz Security Analysis
A skill for understanding and analyzing Mimikatz credential theft techniques for authorized security assessments only .
⚠️ Ethical Use Warning
This skill is designed for:
Authorized penetration testing and red teaming
Security auditing and vulnerability assessment
Incident response and forensic analysis
Security training and education
Defensive security research
Never use these techniques on systems you don't own or have explicit written authorization to test. Unauthorized credential theft is illegal and unethical.
Understanding Mimikatz
Mimikatz is a powerful Windows security tool that can extract credentials from memory. Understanding its capabilities helps security professionals:
Identify attack vectors in their environment
Configure proper defenses
Detect and respond to credential theft attempts
Conduct authorized security assessments
Windows Credential Storage Protections
Modern Windows Security Measures
From Windows 8.1 and Server 2012 R2 onwards:
LM Hashes and Clear-Text Passwords
No longer stored in memory by default
Registry setting to disable Digest Authentication:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
UseLogonCredential = 0 (DWORD)
LSA Protection (Protected Process Light)
SeDebugPrivilege Considerations Administrators typically have SeDebugPrivilege for debugging. This can be restricted to prevent memory dumps. However, the TrustedInstaller account can still perform dumps:
sc config TrustedInstaller binPath= "C:\\Users\\Public\\procdump64.exe -accepteula -ma lsass.exe C:\\Users\\Public\\lsass.dmp"
sc start TrustedInstaller
Detection: Monitor for unusual service configuration changes and process dumps.
Credential Extraction Techniques
LSASS Memory Analysis
Extracts credentials for logged-on users
Works on LSASS memory directly
Defense: Enable LSA Protection, monitor for LSASS access sekurlsa::tickets /export
Extracts Kerberos tickets from memory
Defense: Monitor for ticket extraction attempts
Creates a memory dump of LSASS
Can be analyzed offline
Defense: Monitor for dump creation, use EDR solutions
Credential Dumping Commands Command Purpose Detection Focus sekurlsa::logonpasswordsShow logged-on credentials LSASS memory access sekurlsa::tickets /exportExport Kerberos tickets Ticket file creation lsadump::lsa /injectExtract LSA credentials LSA process injection lsadump::samAccess SAM database SAM file access lsadump::secretsDecrypt registry secrets Registry access patterns vault::cred /patchExtract Windows Vault passwords Vault access
Kerberos Ticket Attacks
Golden Ticket Creates a forged TGT (Ticket Granting Ticket) for domain-wide access.
Domain name
Domain SID
Username to impersonate
KRBTGT account NTLM hash
kerberos::golden /user:<username> /domain:<domain> /sid:<domain_sid> /krbtgt:<ntlm_hash> /ptt
Unusual Kerberos ticket creation
Tickets with suspicious lifetimes
Authentication from unexpected sources
Rotate KRBTGT password twice (invalidates existing tickets)
Monitor for ticket anomalies
Implement Kerberos auditing
Silver Ticket Forges service tickets for specific services.
Service account NTLM hash
Service SPN
Domain SID
kerberos::golden /user:<username> /domain:<domain> /sid:<domain_sid> /target:<service_fqdn> /service:<service_name> /rc4:<ntlm_hash> /ptt
Service ticket anomalies
Authentication to services without proper TGT
Use strong service account passwords
Monitor service authentication patterns
Implement constrained delegation
Trust Ticket Exploits domain trust relationships.
kerberos::golden /domain:<child_domain> /sid:<child_sid> /sids:<trust_sid> /rc4:<ntlm_hash> /user:<username> /service:krbtgt /target:<parent_domain> /ptt
Audit trust relationships regularly
Monitor cross-domain authentication
Implement trust relationship monitoring
Kerberos Ticket Management Command Purpose Use Case kerberos::listList current tickets Reconnaissance kerberos::ptcPass the Cache (inject from file) Ticket reuse kerberos::pttPass the Ticket (inject to memory) Session hijacking kerberos::purgeClear all tickets Pre-attack cleanup
Active Directory Attacks
DCSync Mimics a Domain Controller to request password data.
lsadump::dcsync /user:<target_user> /domain:<target_domain>
Monitor for DC replication requests from non-DC systems
Check for unusual DS-Replication-Get-Changes permissions
Review security event logs for replication events
Restrict DCSync permissions
Monitor replication traffic
Implement privileged access management
DCShadow Makes a machine act as a DC for AD object manipulation.
lsadump::dcshadow /object:<target_object> /attribute:<attribute_name> /value:<new_value>
Monitor for unauthorized DC registration
Check for unusual AD object modifications
Review replication metadata
Monitor DC registration events
Implement AD change auditing
Use AD replication monitoring
Privilege Escalation
Required Privileges Privilege Command Purpose SeDebugPrivilege privilege::debugDebug processes, access LSASS SeBackupPrivilege privilege::backupBackup/restore files, bypass ACLs
Monitor for privilege escalation attempts
Track SeDebugPrivilege usage
Audit backup privilege assignments
Event Log Tampering
Clearing Event Logs Mimikatz doesn't directly clear logs, but attackers may use:
PowerShell: Clear-EventLog
Windows Event Viewer
Third-party tools
Monitor for event log clearing events (Event ID 1102)
Implement log forwarding to SIEM
Use immutable logging where possible
Event Service Patching This experimental command patches the Event Logging Service.
Monitor for Event Log Service changes
Check for service patching attempts
Implement service integrity monitoring
Token and SID Manipulation
Token Elevation token::elevate /domainadmin
Impersonates elevated tokens.
Monitor for token manipulation
Track privilege changes
Audit impersonation attempts
SID Modification sid::add /user:<target_user> /sid:<new_sid>
Modifies SID and SIDHistory.
Monitor for SID changes
Audit SIDHistory modifications
Track group membership changes
Terminal Services Attacks
Multi-RDP Allows multiple RDP sessions.
Monitor for RDP configuration changes
Track concurrent session counts
Audit Terminal Services settings
Defensive Recommendations
Prevention
Enable LSA Protection
Set RunAsPPL registry value
Enforce via Group Policy
Disable Digest Authentication
Set UseLogonCredential to 0
Audit for clear-text password storage
Restrict SeDebugPrivilege
Remove from non-essential accounts
Monitor privilege usage
Implement Credential Guard
Use virtualization-based security
Protect LSASS from memory access
Detection
Monitor LSASS Access
Alert on LSASS process access
Track memory dump creation
Audit Kerberos Activity
Monitor ticket creation and usage
Detect anomalous authentication patterns
Track AD Changes
Monitor for DCSync attempts
Audit DC registration events
Event Log Monitoring
Forward logs to SIEM
Alert on log clearing events
Response
Rotate Compromised Credentials
Change KRBTGT password twice
Reset affected user passwords
Revoke and reissue tickets
Investigate Attack Scope
Review authentication logs
Check for lateral movement
Identify compromised accounts
Harden Environment
Implement missing security controls
Update detection rules
Conduct follow-up assessment
Authorized Testing Checklist Before conducting any security assessment:
References
Important Notes
This skill provides information for defensive security purposes only
Always obtain proper authorization before testing
Document all findings and share with appropriate stakeholders
Use this knowledge to improve security posture, not to exploit vulnerabilities
Stay current with the latest security research and defensive techniques
