You « try » to detect mimikatz
summary
Mimikatz extracts plaintext creds by dumping LSA and process memory and can create golden tickets to impersonate any domain account; demos show driver injection and a smartcard PIN capture that successfully reads auth tokens. Most antivirus products still miss it—version 9 samples run clean on tested machines and vendors rely on brittle blacklists. Root causes are poor credential management, flat trust networks and exposed domain controllers; practical fixes shown are segmentation, protecting secrets and hardening LSA protection, not buying yet another EDR.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 3:45What is mimikatz
- 8:41Antivirus detection limits
- 16:14Post-exploitation techniques
- 22:07Smartcard and credential theft
- 29:01Smartcard PIN capture demo
- 33:58Golden ticket attacks
- 35:31Domain trust and network segregation
- 40:43Why detection is hard
- 43:20Conclusion and recommendations
related talks
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
44mWhere 2 Worlds Collide: Bringing Mimikatz et al to UNIX
58mHacking in 2016 - How is our systems broken?
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
49mPowerShell for Security Incident Response
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
29mWhy You Need to Detect More Than PtH
42mStart Covering Your Bases And Stop Chasing APT Headlines