ATT&CK ReferencesDeply Mimikatz

Deply Mimikatz

Deply, B. (n.d.). Mimikatz. Retrieved September 29, 2015.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software1

Campaigns0

None recorded.

Procedure examples8

Technique	Used by	Procedure example
T1003.001 LSASS Memory	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.002 Security Account Manager	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.004 LSA Secrets	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1003.006 DCSync	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync. Cobalt Strike Manual 4.3 November 2020 Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1207 Rogue Domain Controller	ToolMimikatz	Mimikatz’s `LSADUMP::DCShadow` module can be used to make AD updates by temporarily setting a computer to be a DC. Adsecurity Mimikatz Guide Deply Mimikatz
T1547.005 Security Support Provider	ToolMimikatz	The Mimikatz credential dumper contains an implementation of an SSP. Deply Mimikatz
T1555 Credentials from Password Stores	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI. Cobalt Strike Manual 4.3 November 2020 Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools
T1555.003 Credentials from Web Browsers	ToolMimikatz	Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI. Deply Mimikatz Directory Services Internals DPAPI Backup Keys Oct 2015 GitHub Mimikatz lsadump Module NCSC Joint Report Public Tools

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.