Procedure examples

Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.

GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.

Emotet has been observed dropping and executing password grabber modules including Mimikatz.

Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.

Mafalda can dump password hashes from `LSASS.exe`.

Okrum was seen using MimikatzLite to perform credential dumping.

NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.

Pysa can perform OS credential dumping using Mimikatz.

Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.

Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.

PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.

Qilin can employ an embedded Mimikatz module to dump LSASS memory.

CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.

Lizar can run Mimikatz to harvest credentials.

Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.

Sliver has a built-in `procdump` command allowing for retrieval of memory from processes such as `lsass.exe` for credential harvesting.

SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call.

PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.

Windows Credential Editor can dump credentials.

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.

Lslsass can dump active logon session password hashes from the lsass process.

Empire contains an implementation of Mimikatz to gather credentials from memory.

PoshC2 contains an implementation of Mimikatz to gather credentials from memory.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.

LaZagne can perform credential dumping from memory to obtain account and password information.

Pupy can execute Lazagne as well as Mimikatz using PowerShell.