---
title: "Mimikatz: How cyber attackers harvest credentials post-exploitation"
description: The bad guys got their hands on a powerful tool… and now they use it to get their hands on your passwords.
image: https://blog.teamascend.com/hubfs/Blog%20Feature%20Images/101719_CyberattackSeries-03.jpg
---
[Skip to main content](https://blog.teamascend.com/blog/mimikatz#main)
[ ](https://teamascend.com/)
- [Show submenu for Services Services](http://teamascend.com/services/)
- [Show submenu for IT Consulting IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Healthcare Consulting](https://teamascend.com/services/healthcare/)
- [Show submenu for Cybersecurity Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/)
- [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/)
- [Email Security](https://teamascend.com/services/cybersecurity/email-security/)
- [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/)
- [vCISO](https://teamascend.com/services/cybersecurity/vciso/)
- [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/)
- [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/)
- [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/)
- [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/)
- [Show submenu for IT Infrastructure IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [VCIO](https://teamascend.com/services/infrastructure/vcio/)
- [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/)
- [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/)
- [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/)
- [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/)
- [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/)
- [Product](https://teamascend.com/services/infrastructure/product/)
- [Show submenu for Cloud Cloud](https://teamascend.com/services/cloud-computing/)
- [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/)
- [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/)
- [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/)
- [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/)
- [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/)
- [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/)
- [Show submenu for Microsoft Services Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/)
- [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/)
- [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/)
- [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/)
- [Show submenu for Salesforce Salesforce](https://teamascend.com/salesforce-services/)
- [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/)
- [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/)
- [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/)
- [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/)
- [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/)
- [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
- [Show submenu for Industries Industries](https://teamascend.com/industries/)
- [Financial Services](https://teamascend.com/industries/financial-services/)
- [Private Equity](https://teamascend.com/industries/private-equity/)
- [Insurance](https://teamascend.com/industries/insurance/)
- [Manufacturing](https://teamascend.com/industries/manufacturing/)
- [Healthcare](https://teamascend.com/industries/healthcare/)
- [Legal](https://teamascend.com/industries/legal/)
- [Accounting](https://teamascend.com/industries/accounting/)
- [Show submenu for Resources Resources](https://teamascend.com/resources/)
- [Client Success Stories](https://teamascend.com/client-success-stories/)
- [Events](https://teamascend.com/events/)
- [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions)
- [Blog](https://blog.teamascend.com/)
- [Webinars](https://teamascend.com/resources/?_resource_type=webinar)
- [All Resources](https://teamascend.com/resources/)
- Show submenu for Company Company
- [About Ascend Technologies](https://teamascend.com/about/)
- [Leadership Team](https://teamascend.com/about/team/)
- [Partners With Us](https://teamascend.com/about/partner-with-us/)
- [Awards & Recognitions](https://teamascend.com/about/awards/)
- [Certifications](https://teamascend.com/about/certifications/)
- [Careers](https://teamascend.com/careers/)
- [Internships](https://teamascend.com/careers/internships/)
- [Connect](https://teamascend.com/contact/)
Open main navigation
Close main navigation
- Show submenu for Services Services
- Services
- [Services](http://teamascend.com/services/)
- Show submenu for IT Consulting IT Consulting
- IT Consulting
- [IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Healthcare Consulting](https://teamascend.com/services/healthcare/)
- Show submenu for Cybersecurity Cybersecurity
- Cybersecurity
- [Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/)
- [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/)
- [Email Security](https://teamascend.com/services/cybersecurity/email-security/)
- [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/)
- [vCISO](https://teamascend.com/services/cybersecurity/vciso/)
- [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/)
- [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/)
- [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/)
- [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/)
- Show submenu for IT Infrastructure IT Infrastructure
- IT Infrastructure
- [IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [VCIO](https://teamascend.com/services/infrastructure/vcio/)
- [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/)
- [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/)
- [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/)
- [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/)
- [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/)
- [Product](https://teamascend.com/services/infrastructure/product/)
- Show submenu for Cloud Cloud
- Cloud
- [Cloud](https://teamascend.com/services/cloud-computing/)
- [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/)
- [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/)
- [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/)
- [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/)
- [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/)
- [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/)
- Show submenu for Microsoft Services Microsoft Services
- Microsoft Services
- [Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/)
- [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/)
- [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/)
- [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/)
- Show submenu for Salesforce Salesforce
- Salesforce
- [Salesforce](https://teamascend.com/salesforce-services/)
- [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/)
- [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/)
- [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/)
- [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/)
- [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/)
- [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
- Show submenu for Industries Industries
- Industries
- [Industries](https://teamascend.com/industries/)
- [Financial Services](https://teamascend.com/industries/financial-services/)
- [Private Equity](https://teamascend.com/industries/private-equity/)
- [Insurance](https://teamascend.com/industries/insurance/)
- [Manufacturing](https://teamascend.com/industries/manufacturing/)
- [Healthcare](https://teamascend.com/industries/healthcare/)
- [Legal](https://teamascend.com/industries/legal/)
- [Accounting](https://teamascend.com/industries/accounting/)
- Show submenu for Resources Resources
- Resources
- [Resources](https://teamascend.com/resources/)
- [Client Success Stories](https://teamascend.com/client-success-stories/)
- [Events](https://teamascend.com/events/)
- [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions)
- [Blog](https://blog.teamascend.com/)
- [Webinars](https://teamascend.com/resources/?_resource_type=webinar)
- [All Resources](https://teamascend.com/resources/)
- Show submenu for Company Company
- Company
- [About Ascend Technologies](https://teamascend.com/about/)
- [Leadership Team](https://teamascend.com/about/team/)
- [Partners With Us](https://teamascend.com/about/partner-with-us/)
- [Awards & Recognitions](https://teamascend.com/about/awards/)
- [Certifications](https://teamascend.com/about/certifications/)
- [Careers](https://teamascend.com/careers/)
- [Internships](https://teamascend.com/careers/internships/)
- [Connect](https://teamascend.com/contact/)
- [24/7 Client Services](https://portal-ascend.okta.com/)
[24/7 Client Services](https://portal-ascend.okta.com/)
Endpoint Security, Detection & Response
# Mimikatz: How cyber attackers harvest credentials post-exploitation
TEAM ASCEND
October 16, 2019
- [.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fmimikatz)
- [.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fmimikatz)
- [](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EMimikatz%3A+How+cyber+attackers+harvest+credentials+post-exploitation%3C%2Fspan%3E&body=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fmimikatz)
*The bad guys got their hands on a powerful tool… and now they use it to get their hands on your passwords.*
Criminals of all varieties have known the value of credentials throughout history. Credentials are essentially—in almost every venue for criminal activity— a key that criminals want to steal. ID badges, codes, passwords, and even identities serve as keys for entry into organizations, restricted areas, digital accounts, and more… and the bad guys have found that the best way to “break in” to anything is to simply use the key.
In cyberattacks, gathering or “harvesting” digital credentials and user information takes many forms, some of which include:
- #### **Phishing Scams**
As you learned in the Cyberattack Roster \[link\], phishing campaigns can be designed to achieve a variety of goals, one of which is to collect credentials or valuable data. A phishing campaign designed to harvest credentials may pose as an email from a trusted source—your bank, a retail website, or a common business tool—and inform you of an urgent reason to log into your account immediately. This type of phishing scam is usually partnered with the following method in order to be successful: spoofed login pages.
- #### **Spoofed Login Pages & Fake Websites**
Often paired with a convincing phishing email designed to direct victims to the scam, a spoofed login page or a fake website is another way that the bad guys can harvest legitimate user credentials. A cyber criminal may set up a lookalike login page that looks and acts just like the actual login page for the app or website they are spoofing, like this Microsoft login page for example:
But here’s the trick—when the victim falls for the scam and enters their credentials, the attacker is on the other end collecting the information. After the victim has successfully handed over their credentials, the fake login site may give a “wrong password” message and then redirect the user back to the *real* website to log in, leaving the victim completely unaware that anything malicious has taken place.
- #### **Input Capture (Keylogging)**
Another way attackers collect credentials is through the use of malicious input-capturing software or program (malware) called a “[Keylogger](https://www.csoonline.com/article/3326304/what-is-a-keylogger-how-attackers-can-monitor-everything-you-type.html).” If a bad guy has the opportunity to install malware on their victims’ machines, whether in-person or remotely via other attack vectors, they might utilize a keylogger to capture credentials.
- #### **Post-Exploitation Tools**
Similar to the keylogger approach, an attacker with access to their victim’s machine might utilize malicious software or tools that harvest credentials in ways other than input-capture. One example of this type of tool is Mimikatz.
## **What is Mimikatz?**
Mimikatz is a program that was designed for good, but like many hacker exploits, it became commonly used for evil.
It all started in 2011 with a man named Benjamin Delpy, a French programmer and IT manager by trade who discovered [a security flaw](https://boingboing.net/2017/11/09/password123.html) in the inner workings of Windows operating systems and how they handle password data. He identified the vulnerability to Microsoft, but no immediate action was taken to secure it—Microsoft’s official statement on the vulnerability was simply that, for a hacker to exploit it, the system would have to already be compromised.
This is true—the vulnerability that Delpy discovered is one that can only be exploited in an advanced attack, where a cyber criminal has already gained access to their victim’s machine through other means. However, that doesn’t mean that the vulnerability wasn’t important to address. Delpy knew that in such situations where an attacker was able to exploit this security flaw, it could allow them to expand their access to other systems and compromise an entire network of computers, rather than just one individual machine.
With this in mind, Delpy created the Mimikatz program to demonstrate how easily the flaw could be exploited, how much damage it could create, and in turn, convince Microsoft to address the vulnerability in their operating systems’ designs.
Delpy made the information public so Microsoft and other security professionals could work toward a solution, but he kept the source code of his project closed. He knew the danger of the program he created, but he also understood that if he—a “good guy” in cybersecurity—wasn’t the one to address this flaw, then in time, it would surely have been discovered by a bad guy instead. Unfortunately, those same bad guys caught on to Mimikatz and began working hard to gain access to the source code, attempting to reverse-engineer, recreate, and even [steal the code](https://www.wired.com/story/how-mimikatz-became-go-to-hacker-tool/) directly from Delpy. After a few too many run-ins with men in suits demanding he hand over the program, Delpy released Mimikatz publicly for his own safety.
And thus began the rise of one of the most damaging and widespread hacker tools in the last decade. Mimikatz has been used as a component in many high-profile cyberattacks, including [NotPetya](https://www.wired.com/story/petya-ransomware-outbreak-eternal-blue/), [BadRabbit](https://www.wired.com/story/badrabbit-ransomware-notpetya-russia-ukraine/), attacks on government networks, and more.
#### **How does Mimikatz work?**
[Mimikatz](https://www.varonis.com/blog/what-is-mimikatz/) is an executable program that an attacker (or penetration tester) installs on a machine and runs with administrative-level privileges. This is usually possible in an attack if the attacker has already gained access to the machine, evaded security defenses, and compromised a user’s account—allowing the attacker to execute malicious code and install malicious programs in the system.
The attacker can then use the Mimikatz tool to perform a number of attacks against the Windows authentication system within a machine or network. Mimikatz’s key feature is that it can access and “harvest” or “dump” lists of credentials used in the operating system. The tool can also exploit certain elements of Windows authentication that are *meant* to be security features, like [NTLM hashes](https://medium.com/@petergombos/lm-ntlm-net-ntlmv2-oh-my-a9b235c58ed4) and [Kerberos tickets](https://redmondmag.com/articles/2012/02/01/understanding-the-essentials-of-the-kerberos-protocol.aspx).
With access to so many credentials and authentication mechanisms through Mimikatz, an attacker can easily compromise other accounts and even spread their attack to other computers without having to “break in” the hard way—they can simply use the key.
#### **Credential harvesting in action**
In the short video below, watch as Security Engineer Derrick demonstrates how easily a Mimikatz attack can be executed, and walks through a few methods to prevent and detect this type of attack in your organization.
#### **Cybersecurity Game Plan**
###### *Offense*
If an attacker has the chance to perform a Mimikatz attack in your network, you want to be able to identify the signs and begin taking action as quickly as possible.
With the combination of active security monitoring and intelligent detection technology, a Mimikatz attack can be identified and the attacker’s actions can be investigated in real-time. Using[Endpoint Detection & Response](https://blog.teamascend.com/the-complete-guide-to-edr) (EDR) to identify the unusual activity on the compromised endpoint and further investigation through network log collection using SIEM, security professionals can discover where an attack began, what accounts have been compromised, and create a game plan for your organization’s next steps to eradicate the threat and recover your systems.
###### *Defense*
Mimikatz can easily be stopped, however, before it’s even allowed to run.
As explained in the demonstration above, an effective anti-malware solution can detect and block the Mimikatz program from being installed or executed within your network.
As always, a layered security approach is recommended to protect against all types of attacks. If you can prevent an attacker from gaining access to your systems in the first place, then it’s much less likely that you will need to rely on AV or detection solutions to stop an attack.
[](https://cta-redirect.hubspot.com/cta/redirect/2733374/d534b9a3-49dd-43ed-bea1-15a16ab3565e)
### Table of Contents
#### Get Insights Sent to Your Inbox
## Related Articles
Endpoint Security, Detection & Response
### [How to Build an AI Governance Framework a Lean IT Team Can Run](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend)
September 24, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend)
Endpoint Security, Detection & Response
### [How to Choose the Right Salesforce Products for Your Business](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business)
September 22, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business)
Endpoint Security, Detection & Response
### [What Is Shadow AI, and Why Is It a Compliance Risk Right Now?](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries)
September 17, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries)
[](https://teamascend.com/)
Contact
833-639-2285
-
-
-
-
-
- Company
- [About](https://teamascend.com/about/)
- [Services](https://teamascend.com/services/)
- [Testimonials](https://teamascend.com/client-success-stories/)
- [Partner With Us](https://teamascend.com/about/partner-with-us/)
- [Resources](https://teamascend.com/resources/)
- [Contact](https://teamascend.com/contact/)
- [Careers](https://teamascend.com/careers/)
- Services
- [IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [Cloud](https://teamascend.com/services/cloud-computing/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Salesforce Services](https://teamascend.com/salesforce-services/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
### Empowering Technology. Powered by People.
Technology is critical to businesses across all industries. Today's technology must be smart, reliable, adaptable, and secure. At Ascend Technologies, we deliver solutions at the highest level, from cloud computing to proactive cybersecurity strategies to Salesforce excellence. And the team? As impressive as the tech. Our practical support is focused on one thing: your success. Let's see what we can do together.
[Contact Us](https://teamascend.com/contact/)
©2026 Ascend Technologies, LLC, All Rights Reserved | [Privacy Policy](https://teamascend.com/privacy-policy/)
```json
{
"@context" : "https://schema.org",
"@type" : "WebPage",
"breadcrumb" : {
"@type" : "BreadcrumbList",
"itemListElement" : [ {
"@type" : "ListItem",
"item" : "https://blog.teamascend.com",
"name" : "Home",
"position" : 1
} ]
},
"dateModified" : "2023-10-20T14🇲🇲59",
"description" : "The bad guys got their hands on a powerful tool… and now they use it to get their hands on your passwords.\n",
"name" : "Mimikatz: How cyber attackers harvest credentials post-exploitation",
"primaryImageOfPage" : {
"@type" : "ImageObject",
"url" : "https://content.teamascend.com/hubfs/Blog%20Feature%20Images/101719_CyberattackSeries-03.jpg"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://content.teamascend.com/hubfs/Ascend-Technologies-HubSpot-Logo.png"
},
"name" : "Ascend Technologies",
"url" : "https://blog.teamascend.com"
},
"url" : "https://blog.teamascend.com/blog/mimikatz"
}
```