Skip to content

Back to the catalog

Mimikatz Missing Manual
github.comrepo

Mimikatz Missing Manual

A deep-dive, self-paced manual on Mimikatz and Windows identity internals by Carlos Perez (DarkOperator), refined with input from Benjamin Delpy (Mimikatz's author). It covers LSASS credential dumping, Kerberos ticket forgery/roasting/delegation abuse, PKI/smart card and certificate abuse, DCSync/DCShadow domain persistence, and DPAPI secrets, alongside blue team detection strategies and event log signatures.

TL;DR A comprehensive, publicly released manual explaining Mimikatz internals, Kerberos/PKI/DPAPI attacks, and their detections.
Open original ↗

Organisations named here

  • Carlos Perez
  • DarkOperator

Technologies named here

  • DataProtectionProvider / DPAPI
  • Windows
  • Mimikatz
  • MkDocs
  • Kerberos
  • Active Directory
  • LSASS

Techniques named here

  • Token, process, and service manipulation
  • RPC abuse
  • LSASS credential dumping
  • Memory patching
  • Kernel-level access for credential access
  • Kerberos ticket forgery
  • Kerberos roasting
  • Kerberos delegation abuse
  • Smart Card identity abuse
  • Software-based certificate identity abuse
  • DCSync
  • NetSync
  • DCShadow
  • DPAPI master key and backup key extraction
  • Kerberoasting

Also named here

  • Benjamin Delpy

Related in Offensive Security