mimikatz

Mimikatz is an open source malware program used by hackers and penetration testers to gather credentials on Windows computers. Coded by Benjamin Deply in 2007, mimikatz was originally created to be a proof of concept to learn about Microsoft authentication protocol vulnerabilities. However, mimikatz has since become a popularly downloaded hacking tool.

In order to function completely, mimikatz requires administrator or full system controls. A mimikatz attack uses several techniques to find sensitive information such as plaintext passwords, hash, pin codes, and tickets from the memory of a system. The collected credentials can then be used to access unauthorized information or perform lateral movement attacks.

While mimikatz is generally used as an underground and harmful tool, and spreading malware viruses is illegal in most countries, some professionals may still advertise this as a skill they perform within the commercial hacking industry. This is where companies hire white hat hackers to help them search for weaknesses in their own security systems.  

There are always new ways to hack a computer using mimikatz, so defenses against it need to be adaptable and updated to stay effective. A mimikatz attack is hard to detect, but it is possible to check whether a machine or account is compromised. It is easier to execute a mimikatz attack in a system with wide access, because it stores several credentials under one access point. For example, a user that runs Windows with a single sign-on (SSO) system.