Mimikatz
- ID
- S0002
- Type
- Tool
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]
Techniques used (17)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.004 LSA Secrets
- T1003.006 DCSync
- T1098 Account Manipulation
- T1134.005 SID-History Injection
- T1207 Rogue Domain Controller
- T1547.005 Security Support Provider
- T1550.002 Pass the Hash
- T1550.003 Pass the Ticket
- T1552.004 Private Keys
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1555.004 Windows Credential Manager
- T1558.001 Golden Ticket
- T1558.002 Silver Ticket
- T1649 Steal or Forge Authentication Certificates
Groups using it (51)
- G0003 Cleaver
- G0004 Ke3chang
- G0006 APT1
- G0007 APT28
- G0008 Carbanak
- G0010 Turla
- G0011 PittyTiger
- G0016 APT29
- G0027 Threat Group-3390
- G0034 Sandworm Team
- G0035 Dragonfly
- G0037 FIN6
- G0045 menuPass
- G0046 FIN7
- G0049 OilRig
- G0050 APT32
- G0059 Magic Hound
- G0060 BRONZE BUTLER
- G0064 APT33
- G0069 MuddyWater
- G0076 Thrip
- G0077 Leafminer
- G0079 DarkHydrus
- G0080 Cobalt Group
- G0082 APT38
- G0087 APT39
- G0088 TEMP.Veles
- G0092 TA505
- G0093 GALLIUM
- G0094 Kimsuky
- G0096 APT41
- G0102 Wizard Spider
- G0107 Whitefly
- G0108 Blue Mockingbird
- G0114 Chimera
- G0119 Indrik Spider
- G0129 Mustang Panda
- G0131 Tonto Team
- G0135 BackdoorDiplomacy
- G1001 HEXANE
- G1004 LAPSUS$
- G1006 Earth Lusca
- G1015 Scattered Spider
- G1016 FIN13
- G1017 Volt Typhoon
- G1023 APT5
- G1024 Akira
- G1030 Agrius
- G1040 Play
- G1043 BlackByte
- G1051 Medusa Group
