Browse Definitions :
Definition

mimikatz

Contributor(s): Laura Fitzgibbons

Mimikatz is an open source malware program used by hackers and penetration testers to gather credentials on Windows computers. Coded by Benjamin Deply in 2007, mimikatz was originally created to be a proof of concept to learn about Microsoft authentication protocol vulnerabilities. However, mimikatz has since become a popularly downloaded hacking tool.

In order to function completely, mimikatz requires administrator or full system controls. A mimikatz attack uses several techniques to find sensitive information such as plaintext passwords, hash, pin codes, and tickets from the memory of a system. The collected credentials can then be used to access unauthorized information or perform lateral movement attacks.

While mimikatz is generally used as an underground and harmful tool, and spreading malware viruses is illegal in most countries, some professionals may still advertise this as a skill they perform within the commercial hacking industry. This is where companies hire white hat hackers to help them search for weaknesses in their own security systems.  

There are always new ways to hack a computer using mimikatz, so defenses against it need to be adaptable and updated to stay effective. A mimikatz attack is hard to detect, but it is possible to check whether a machine or account is compromised. It is easier to execute a mimikatz attack in a system with wide access, because it stores several credentials under one access point. For example, a user that runs Windows with a single sign-on (SSO) system.

Common types of mimikatz attacks

  • Clear text password stealing: Passwords are stored on machines in a predictable, unencrypted state, allowing them to be searched within in a database.
  • Pass-the-hash attack: An attack that involves reusing credentials that are stored in a system without actually finding out what they are, but persisting them to an account or part of a system that the attacker would not normally be able to access.
  • Golden ticket attack: A golden ticket attack involves creating a false authentication within Kerberos, an authentication protocol that verifies users and servers before information is exchanged. The false credential, or golden ticket, gives attackers access to complete any number of unauthorized changes to system accounts and groups
This was last updated in January 2019

Continue Reading About mimikatz

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

What do you think the next common type of security threat will be and how can security professionals stay ahead of it?
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

SearchCompliance

  • PCI DSS (Payment Card Industry Data Security Standard)

    The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to ...

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

  • compliance framework

    A compliance framework is a structured set of guidelines that details an organization's processes for maintaining accordance with...

SearchSecurity

  • Trojan horse (computing)

    In computing, a Trojan horse is a program downloaded and installed on a computer that appears harmless, but is, in fact, ...

  • identity theft

    Identity theft, also known as identity fraud, is a crime in which an imposter obtains key pieces of personally identifiable ...

  • DNS over HTTPS (DoH)

    DNS over HTTPS (DoH) is a relatively new protocol that encrypts domain name system traffic by passing DNS queries through a ...

SearchHealthIT

  • telemedicine (telehealth)

    Telemedicine is the remote delivery of healthcare services, such as health assessments or consultations, over the ...

  • Project Nightingale

    Project Nightingale is a controversial partnership between Google and Ascension, the second largest health system in the United ...

  • medical practice management (MPM) software

    Medical practice management (MPM) software is a collection of computerized services used by healthcare professionals and ...

SearchDisasterRecovery

SearchStorage

  • M.2 SSD

    An M.2 SSD is a solid-state drive (SSD) that conforms to a computer industry specification and is used in internally mounted ...

  • kilobyte (KB or Kbyte)

    A kilobyte (KB or Kbyte) is a unit of measurement for computer memory or data storage used by mathematics and computer science ...

  • virtual memory

    Virtual memory is a memory management capability of an operating system (OS) that uses hardware and software to allow a computer ...

Close