Tool
tool:mimikatz
Credential-extraction tool used on a Windows web development server to obtain usernames and clear-text passwords from memory.
Credential-extraction tool used on a Windows web development server to obtain usernames and clear-text passwords from memory.
“They used a tool called Mimikatz.”
“Mimikatz knows exactly where to look to dig that password out of memory.”
An open-source Windows credential-extraction and authentication-manipulation tool used in the episode’s description of NotPetya propagation.
“the hackers used a tool called Mimikatz.”
“That tool he made is called Mimikatz and he made it open-source”
Credential-dumping tool used to extract credentials from Windows memory.
“It was called thehostingoftheserver.mimikatz.hash.”
“Mimikatz is a tool that goes to the exact spot in memory and grabs the password”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DEVELOPED_BY | Benjamin Delpy | Explicit | 54 |
| outgoing | EXPLOITS | Windows password handling flaw | Explicit | 103 |
| outgoing | USES | credential dumping | Explicit | 103 |
| incoming | INVOLVES | Las Vegas Sands cyber-attack | Explicit | 37 |
| incoming | USES | NotPetya | Explicit | 54 |
| incoming | USES | Cloud Hopper | Explicit | 103 |
Las Vegas Sands cyber-attack INVOLVES Mimikatz
The attackers used Mimikatz on a web development server to obtain usernames and passwords.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They used a tool called Mimikatz”
“these hackers ran Mimikatz on this web development server”
Mimikatz DEVELOPED_BY Benjamin Delpy
Benjamin Delpy built Mimikatz to extract usernames and passwords from memory.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“He built a tool to extract this username and password to display it to anyone who wants to see it. That tool he made is called Mimikatz”
The episode says the hackers used Mimikatz to obtain credentials and help the worm spread through networks.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“the hackers used a tool called Mimikatz”
Cloud Hopper USES Mimikatz
The attackers ran Mimikatz on the jump server and obtained nearly one hundred clear-text credentials, including Active Directory administrators.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“including several Active Directory domain administrators”
“It was called thehostingoftheserver.mimikatz.hash.”
Mimikatz EXPLOITS Windows password handling flaw
Mimikatz extracts passwords from Windows memory where clear-text credentials may be cached.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“Windows has a major flaw in the way it handles passwords.”
“Mimikatz is a tool that goes to the exact spot in memory and grabs the password”
Mimikatz USES credential dumping
Mimikatz was used to dump usernames and passwords from the compromised system.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“Mimikatz found a lot of passwords”