🧰 Mimikatz

The items that name it 22

• The First 24 Hours: What Happens When Ransomware Lands
  writeupas tools2026-10-02

  Used by Akira operators to dump credentials, per CISA advisory

• The Fine Art of Frustrating the Adversary
  articleas tools2026-10-01

  Credential-dumping tool cited as one of several possible implementations an adversary could use to access credential material (e.g., LSASS).

• Field Notes: Reconstructing the Attacker's LSASS Dump
  writeupas classification.technologies2026-09-30
• MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker
  writeupas tools2026-08-14

  Credential dumping tool; actively re-purposed/used by Majinahanashi group during operations

• npm Now Scans for Malware at Publish, Not Install | Blog | Endor Labs
  articleas tools2026-08-12

  Security testing tool used to test Windows credential defenses by pulling passwords from memory; also used by attackers for the same purpose; has its own page in the MITRE ATT&CK catalog

• Mimikatz Missing Manual
  repoas tools2026-07-31

  Manipulating Windows Identity, Kerberos, and PKI protocols; dumping secrets, patching memory, kernel-level access, ticket forgery, DCSync, DCShadow, DPAPI secrets

• awesome-osint-arsenal
  repoas tools2026-07-31It is written here as Mimikatz (Windows credential dumper).

  Windows credential dumper

• CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress
  writeupas tools2026-07-09

  Used to dump credentials, run from anomalous directories such as C:\Binaries.

• Lateral Movement Attack: Techniques, Detection & Prevention
  writeupas tools2026-07-01

  Used by attackers to pull credentials from memory

• Defence Impairment Olympics
  writeupas tools2026-06-29It is written here as Mimikatz (mimidrv.sys).

  Kernel driver used to dump credentials from memory during the attack, later deleted by the threat actor

• Fantastic clear-text passwords and where to collect them (Part 2 - Windows)
  writeupas tools2026-06-28

  Credential-dumping tool; used in cases for LSASS dumping, logging cleartext passwords under the wdigest section, and provides mimilib.dll used as a malicious Security Support Provider.

• nikaiw/VMkatz
  repoas tools2026-05-22

  reference implementation by Benjamin Delpy (@gentilkiwi) for LSASS internals and Windows credential decryption; VMkatz implements all 9 SSP credential providers mimikatz implements

• 0xMohammedHassan/morphkatz
  repoas classification.technologies2026-05-07
• 0xSteph/pentest-ai-agents
  repoas classification.technologies2026-05-06
• A Idealistic View of Malware Analysis Definitions
  articleas tools2026-01-13

  credential dumping tool used as example of known-malicious software detected via file hash or LSASS memory access

• Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?
  writeupas tools2025-11-20

  Dual-use tool previously misused by threat actors, per Huntress 2025 Cyber Threat Report

• Manual Configuration Manager (SCCM) credential harvesting
  writeupas tools2025-10-05

  live extraction of DPAPI_SYSTEM keys from LSA secrets (alternative to the offline method described)

• Unpacking the AAD Broker LocalState Cache
  writeupas tools2025-09-30

  Used via 'mimikatz.exe dpapi::cloudapkd /keyvalue:<OpaqueKey> /keyname:<SK-GUID>' to derive the PRT session key from the opaque key material

• Tear Down The Castle - Part 1
  writeupas tools2025-01-19

  Used to extract cleartext service account passwords from the LSA database

• Kernel Drivers, Process Protection, and ...Bears?
  writeupas classification.technologies2023-08-22
• Cobalt Strike and Tradecraft
  writeupas tools2021-07-26

  Credential theft tool used under the hood by Cobalt Strike's pth command to create a new logon session and copy access tokens for pass-the-hash

• Kerberosity Killed the Domain: An Offensive Kerberos Overview
  articleas tools2020-03-10

  Forge Golden Ticket TGTs using the KRBTGT account's RC4 password hash