CmdID

CmdID / Commands

mimikatz-lsadump

Dump secrets from the Windows Local Security Authority (LSA). tldr-pages

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Dump secrets from the Windows Local Security Authority (LSA). Requires SYSTEM privileges.

Dump SAM hashes

mimikatz "lsadump::sam"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Dump secrets from the SECURITY hive

mimikatz "lsadump::secrets"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Dump cached domain credentials

mimikatz "lsadump::cache"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton