Mimikatz

Mimikatz was created by French programmer Benjamin Delpy, known by the online handle gentilkiwi. According to accounts of its origin, Delpy discovered while teaching himself the C programming language that Windows systems could, under certain conditions, hold both an encrypted copy of a user's password and the key needed to decrypt it in memory at the same time. Delpy reported the weakness to Microsoft, but the company reportedly told him the finding was not a serious concern because it would require a machine to already be compromised. Delpy built Mimikatz as a proof-of-concept exploiting the issue.

Delpy released the first version of Mimikatz in May 2011 as closed-source software. Its capabilities spread quickly: by September 2011 the technique had already surfaced in the breach of Dutch certificate authority DigiNotar, an attack attributed to Iranian-linked actors that led to fraudulent certificates and DigiNotar's eventual collapse. Delpy later released the Mimikatz source code publicly after presenting the tool at the Positive Hack Days security conference in Moscow, reasoning that defenders needed access to the code to understand and counter the attack technique it demonstrated.

How Mimikatz Works

Mimikatz's core technique targets the Local Security Authority Subsystem Service (LSASS), the Windows process responsible for enforcing security policy and handling user authentication. LSASS caches credential material in memory so users are not repeatedly prompted for passwords; Mimikatz reads this memory space to recover plaintext passwords, NTLM password hashes, and Kerberos tickets, typically requiring administrator or SYSTEM-level access. Extracted material can be reused directly in pass-the-hash and pass-the-ticket attacks. More advanced Mimikatz functions can forge Kerberos tickets outright, granting domain-wide access in Active Directory environments once an initial foothold is gained.

Dual-Use Legacy and Real-World Impact

Mimikatz occupies a dual-use role in computer security. Penetration testers and red teams use it to demonstrate credential-theft risks in authorized assessments, while it has also been abused extensively by real-world attackers. Beyond the 2011 DigiNotar breach, it has been associated with the Carbanak banking-fraud campaign and the cyberattack on the German Bundestag. Its most destructive documented use came in June 2017, when the NotPetya wiper malware incorporated a modified Mimikatz-based credential-dumping component to harvest Windows credentials and spread laterally across networks, combining this with the leaked EternalBlue exploit to cause billions of dollars in global damage.

Mimikatz's success prompted direct defensive responses from Microsoft. Windows 8.1 disabled the WDigest authentication protocol by default, closing off a common source of recoverable plaintext passwords in LSASS memory. More significantly, Microsoft introduced Windows Defender Credential Guard, which uses virtualization-based security to isolate derived credentials from the operating system. Despite these mitigations, Mimikatz remains one of the most consequential and enduring post-exploitation tools in the history of Windows security.

Timeline

• 2011-05Mimikatz is first publicly released by Benjamin Delpy as closed-source software.
• 2011-09The Mimikatz technique is used in the breach of Dutch certificate authority DigiNotar.
• 2012Delpy presents Mimikatz at the Positive Hack Days conference in Moscow and releases its source code publicly.
• 2013-10Microsoft ships Windows 8.1, disabling the WDigest protocol by default in response to credential-theft risk.
• 2017-06The NotPetya wiper malware uses a modified Mimikatz-based credential-dumping module combined with EternalBlue to spread worldwide.
• 2017-10The BadRabbit ransomware outbreak incorporates Mimikatz-derived credential harvesting for network propagation.