CmdID

CmdID / Commands

mimikatz-vault

Extract credentials stored in the Windows Credential Vault. tldr-pages

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

List vault credentials

mimikatz "vault::list"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Dump all vault credentials

mimikatz "vault::cred"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton