ATT&CK ReferencesAdsecurity Mimikatz Guide

Adsecurity Mimikatz Guide

Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz & Command Reference. Retrieved December 23, 2015.

Open the source

Techniques1

T1207Rogue Domain Controller

Groups0

None recorded.

Software1

Mimikatz

Campaigns0

None recorded.

Procedure examples7

Technique	Used by	Procedure example
T1098 Account Manipulation	ToolMimikatz	The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The `LSADUMP::ChangeNTLM` and `LSADUMP::SetNTLM` modules can also manipulate the password hash of an account without knowing the clear text value. Adsecurity Mimikatz Guide Metcalf 2015
T1134.005 SID-History Injection	ToolMimikatz	Mimikatz's `MISC::AddSid` module can append any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain. AdSecurity Kerberos GT Aug 2015 Adsecurity Mimikatz Guide
T1207 Rogue Domain Controller	ToolMimikatz	Mimikatz’s `LSADUMP::DCShadow` module can be used to make AD updates by temporarily setting a computer to be a DC. Adsecurity Mimikatz Guide Deply Mimikatz
T1550.002 Pass the Hash	ToolMimikatz	Mimikatz's `SEKURLSA::Pth` module can impersonate a user, with only a password hash, to execute arbitrary commands. Adsecurity Mimikatz Guide Cobalt Strike Manual 4.3 November 2020 NCSC Joint Report Public Tools
T1550.003 Pass the Ticket	ToolMimikatz	Mimikatz’s `LSADUMP::DCSync` and `KERBEROS::PTT` modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets. AdSecurity Kerberos GT Aug 2015 Adsecurity Mimikatz Guide Harmj0y DCSync Sept 2015 NCSC Joint Report Public Tools
T1552.004 Private Keys	ToolMimikatz	Mimikatz's `CRYPTO::Extract` module can extract keys by interacting with Windows cryptographic application programming interface (API) functions. Adsecurity Mimikatz Guide
T1649 Steal or Forge Authentication Certificates	ToolMimikatz	Mimikatz's `CRYPTO` module can create and export various types of authentication certificates. Adsecurity Mimikatz Guide

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.