CmdID

CmdID / Commands

mimikatz-sekurlsa

Extract credentials and secrets from memory. tldr-pages

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Extract credentials and secrets from memory. Requires debug privileges.

Extract plaintext passwords

mimikatz "sekurlsa::logonpasswords"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

List Kerberos tickets in memory

mimikatz "sekurlsa::tickets"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Dump LSA secrets

mimikatz "sekurlsa::secrets"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton