CmdID

CmdID / Commands

mimikatz-dpapi

Interact with the Windows Data Protection API (DPAPI). tldr-pages

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

List master keys

mimikatz "dpapi::masterkey /list"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Decrypt a DPAPI blob

mimikatz "dpapi::blob /in:blob_file.bin"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Retrieve Chrome credentials using DPAPI

mimikatz "dpapi::chrome /in:Login Data"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton