Browse Definitions :
Definition

mimikatz

Contributor(s): Laura Fitzgibbons

Mimikatz is an open source malware program used by hackers and penetration testers to gather credentials on Windows computers. Coded by Benjamin Deply in 2007, mimikatz was originally created to be a proof of concept to learn about Microsoft authentication protocol vulnerabilities. However, mimikatz has since become a popularly downloaded hacking tool.

In order to function completely, mimikatz requires administrator or full system controls. A mimikatz attack uses several techniques to find sensitive information such as plaintext passwords, hash, pin codes, and tickets from the memory of a system. The collected credentials can then be used to access unauthorized information or perform lateral movement attacks.

While mimikatz is generally used as an underground and harmful tool, and spreading malware viruses is illegal in most countries, some professionals may still advertise this as a skill they perform within the commercial hacking industry. This is where companies hire white hat hackers to help them search for weaknesses in their own security systems.  

There are always new ways to hack a computer using mimikatz, so defenses against it need to be adaptable and updated to stay effective. A mimikatz attack is hard to detect, but it is possible to check whether a machine or account is compromised. It is easier to execute a mimikatz attack in a system with wide access, because it stores several credentials under one access point. For example, a user that runs Windows with a single sign-on (SSO) system.

Common types of mimikatz attacks

  • Clear text password stealing: Passwords are stored on machines in a predictable, unencrypted state, allowing them to be searched within in a database.
  • Pass-the-hash attack: An attack that involves reusing credentials that are stored in a system without actually finding out what they are, but persisting them to an account or part of a system that the attacker would not normally be able to access.
  • Golden ticket attack: A golden ticket attack involves creating a false authentication within Kerberos, an authentication protocol that verifies users and servers before information is exchanged. The false credential, or golden ticket, gives attackers access to complete any number of unauthorized changes to system accounts and groups
This was last updated in January 2019

Continue Reading About mimikatz

SearchCompliance

SearchSecurity

  • cyber attack

    A cyber attack is any attempt to gain unauthorized access to a computer, computing system or computer network with the intent to ...

  • backdoor (computing)

    A backdoor is a means to access a computer system or encrypted data that bypasses the system's customary security mechanisms.

  • post-quantum cryptography

    Post-quantum cryptography, also called quantum encryption, is the development of cryptographic systems for classical computers ...

SearchHealthIT

SearchDisasterRecovery

  • risk mitigation

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • call tree

    A call tree is a layered hierarchical communication model that is used to notify specific individuals of an event and coordinate ...

  • Disaster Recovery as a Service (DRaaS)

    Disaster recovery as a service (DRaaS) is the replication and hosting of physical or virtual servers by a third party to provide ...

SearchStorage

Close