The tool that taught the industry Windows remembers too much: plaintext passwords, hashes and Kerberos tickets pulled from memory. Defenders study it to kill what makes it work.
Follow the steps — click any step card to replay the terminal demo from that point. Everything runs in a lab you control.
Needs debug privilege: local admin context.
You just met LSASS memory — and why Credential Guard exists.
Hashes authenticate without knowing the password.
Ticket reuse = golden/pass-the-ticket territory.
Run it → detect it → block it. THAT is purple teaming.
| privilege::debug | required rights |
| sekurlsa::logonpasswords | creds from memory |
| sekurlsa::msv | hashes/keys |
| kerberos::golden | forge tickets (lab) |
| lsadump::sam | local account hashes |
Windows Credential Guard kills LSASS dumps — learn why blue teams love it.
Local admin password reuse + mimikatz = domain compromise; LAPS exists because of this.
Anti-malware flags it instantly — watch Defender/EDR respond (lab telemetry feast).
Safe lab handling: isolated VM, snapshots, treat as live sample.
Use Mimikatz only on systems you own or have written permission to test. Your lab: Kali + Metasploitable2, DVWA, TryHackMe & HackTheBox — plenty of legal targets, zero risk.