> For the complete documentation index, see [llms.txt](https://l0u51f3r007.gitbook.io/attacking-and-defending-active-directory-crtp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://l0u51f3r007.gitbook.io/attacking-and-defending-active-directory-crtp/mimikatz.md).

# Mimikatz

About Modules and Commands

## Modules -

* [`crypto`](#crypto): This modules deals with the Microsoft Crypto Magic world.
* [`dpapi`](#dpapi): The Data Protection Application Programming Interface module. Consider this as an opsec safe option for getting credentials.
* [`event`](#event): this module deals with the Windows Event logs (to clear footprints after compromise).
* [`kerberos`](#kerberos): This module deals with the kerberos lol.
* [`lsadump`](#lsadump): this module contains some well known functionalities of Mimikatz such as DCSync, DCShadow, dumping of SAM and LSA Secrets.
* [`misc`](#misc): The miscellaneous module contains functionalities such as PetitPotam, PrintNightmare RPC Print Spooler and others.
* [`net`](#net): some functionalities in this module are similar to the Windows **net** commands. Enumerating sessions and servers configured with different types of Kerberos delegations is also included.
* [`privilege`](#privilege): This module deals with the Windows privileges. It includes the favorite debug privilege which holds the keys to LSASS.
* [`process`](#process): This module deal with Windows processes. It can also be used for process injection and parent process spoofing.
* [`rpc`](#rpc): The Remote Procedure Call module of Mimikatz. It can also be used for controlling Mimikatz remotely. 
* [`sekurlsa`](#sekurlsa): The most beloved module of Mimikatz. Even the maker of Mimikatz (Benjamin) has mentioned in the past that one day people will discover that Mimikatz is more than [`sekurlsa::logonpasswords`](broken://pages/XYfeDv8JS9zn241cvb4e). 
* [`service`](#service): This module can interact with Windows services plus installing the `mimikatzsvc` service.
* [`sid`](#sid):  This module deals with the Security Identifier.
* [`standard`](#standard): This module contains some general functionalities which are not related to exploitation.
* [`token`](#token): This module deals with the Windows tokens (who does not really like elevating to `NT AUTHORITY\ SYSTEM`).
* [`ts`](#ts): This module deals with the Terminal Services. It can be an alternative for getting clear-text passwords. 
* [`vault`](#vault): This module dumps passwords saved in the Windows Vault.

## Commands -

### crypto

* [`crypto::capi`](broken://pages/10dITkzuxR6XopifKRak) patches CryptoAPI layer for easy export (Experimental :warning:)
* [`crypto::certificates`](broken://pages/SDPs5rjTO8JPq7fEfRpU) lists or exports certificates
* [`crypto::certtohw`](broken://pages/uSXhGD6VKiyHmW0Qrv13) tries to export a software CA to a crypto (virtual) hardware
* [`crypto::cng`](broken://pages/UVxAkQKJekuskhsyp0w0) patches the CNG (Cryptography API: Next Generation) service for easy export (Experimental :warning:)
* [`crypto::extract`](broken://pages/5LfijwRdi4TgWfYUkaL7) extracts keys from the CAPI RSA/AES provider (Experimental :warning:)
* [`crypto::hash`](broken://pages/a5HIB9C4brXpeIOaScHG) hashes a password in the main formats (NT, DCC1, DCC2, LM, MD5, SHA1, SHA2) with the username being an optional value
* [`crypto::keys`](broken://pages/yo5KpTN68bXvS4PEvK6m) lists or exports key containers
* [`crypto::providers`](broken://pages/KmslhbfhDL6VWnvFhKyH) lists cryptographic providers
* [`crypto::sc`](broken://pages/QE351dBx0gsbeW7jceoA) lists smartcard/token reader(s) on, or deported to, the system. When the CSP (Cryptographic Service Provider) is available, it tries to list keys on the smartcard
* [`crypto::scauth`](broken://pages/VROy6GmHwWCTlglBfiNb) it creates a authentication certificate (smartcard like) from a CA
* [`crypto::stores`](broken://pages/myCvxP2ZKuuKgBMPGQ5M) lists cryptographic stores
* [`crypto::system`](broken://pages/PQwacvTlnl8ogNoduyjq) it describes a Windows System Certificate
* [`crypto::tpminfo`](broken://pages/dJxtiVFSbTjuBlCq1tgK) displays information for the Microsoft's TPM Platform Crypto Provider

### dpapi

* [`dpapi::blob`](broken://pages/LF2aexgM2tDW4kuaa8jq) describes a DPAPI blob and unprotects/decrypts it with API or Masterkey
* [`dpapi::cache`](broken://pages/NS5Y5nD7W1r0v5cYjUpZ) displays the credential cache of the DPAPI module
* [`dpapi::capi`](broken://pages/gp9DRJoGdM7hviYNyNBe) decrypts a CryptoAPI private key file
* [`dpapi::chrome`](broken://pages/4zhA9MPNJBAu3utf5EjQ) dumps stored credentials and cookies from Chrome
* [`dpapi::cloudapkd`](broken://pages/3gsiLSSOsd6ab48RRv3f) is undocumented at the moment
* [`dpapi::cloudapreg`](broken://pages/gXUe3FKPurwaVpMV0YfE) dumps azure credentials by querying the following registry location
* [`dpapi::cng`](broken://pages/WAAb21OMRw7u87MpXdlu) decrypts a given CNG private key file
* [`dpapi::create`](broken://pages/4REVpNBTzcslOT8ypLee) creates a DPAPI Masterkey file from raw key and metadata
* [`dpapi::cred`](broken://pages/5gmrsn2g1NPunznwfXkL) decrypts DPAPI saved credential such as RDP, Scheduled tasks, etc (cf. [dumping DPAPI secrets](https://www.thehacker.recipes/ad-ds/movement/credentials/dumping/dpapi-protected-secrets))
* [`dpapi::credhist`](broken://pages/cYICAeC3reT1afF3ofyG) describes a Credhist file
* [`dpapi::luna`](broken://pages/U6n2jbK6Z0BSdfMHurTN) decrypts Safenet LunaHSM KSP
* [`dpapi::masterkey`](broken://pages/AWINnxGooqWMCljdgGem) describes a Masterkey file and unprotects each Masterkey (key depending). In other words, it can decrypt and request masterkeys from active directory
* [`dpapi::protect`](broken://pages/Tl4ZL5hR8nHDPop6Nx9a) protects data via a DPAPI call
* [`dpapi::ps`](broken://pages/ZRkcEQQtYihkZA0ck2m2) decrypts PowerShell credentials (PSCredentials or SecureString)
* [`dpapi::rdg`](broken://pages/JrwMMoSWc0K2uqLyfjqJ) decrypts Remote Desktop Gateway saved passwords
* [`dpapi::sccm`](broken://pages/hKZy1Z4SXW6QMoRkFVky) is used to decrypt saved SCCM credentials
* [`dpapi::ssh`](broken://pages/7glEuMw27cj4jpdZQn4s) extracts OpenSSH private keys
* [`dpapi::tpm`](broken://pages/THVQSwszkrqL9QnHwp0p) decrypts TPM PCP key file ([Microsoft's TPM Platform Crypto Provider](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/setting-up-tpm-protected-certificates-using-a-microsoft/ba-p/1129055) (PCP))
* [`dpapi::vault`](broken://pages/WpwLr9wudWr3wOOq1Z3w) decrypts DPAPI vault credentials from the [Credential Store](https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0)
* [`dpapi::wifi`](broken://pages/NTEXlda4nit8yvlp329T) decrypts saved Wi-Fi passwords
* [`dpapi::wwman`](broken://pages/CYA0dUguR2KiRtd1yUOS) decrypts Wwan credentials

### event

* [`event::clear`](broken://pages/-MkbtTeXnB7hm9ugvByg) clears a specified event log
* [`event::drop`](broken://pages/-Mkbnqth6pzjiu7EPUtX) patches event services to avoid new events ( :warning: experimental)

### kerberos

* [`kerberos::ask`](broken://pages/RfeI9SO8pNeuerj15Kdr) can be used to obtain Service Tickets. The Windows native command is [`klist get`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist)
* [`kerberos::clist`](broken://pages/NN26nZA6Pm0FAR4igYsW) lists tickets in [MIT](https://web.mit.edu/kerberos/)/[Heimdall](https://github.com/heimdal/heimdal) ccache format. It can be useful with other tools (i.e. ones that support [Pass the Cache](https://www.thehacker.recipes/ad/movement/kerberos/ptc))
* [`kerberos::golden`](broken://pages/BKwliRpo2eo5Y1uG0MkI) can be used to [forge golden and silver tickets](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets). It can also be used for forging inter-realm trust keys
* [`kerberos::hash`](broken://pages/sMwGBcMR9NprMKWz91fN) computes the different types of Kerberos keys for a given password
* [`kerberos::list`](broken://pages/NXgygyecdOwPKpgJVbvq) has a similar functionality to [`klist`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist) command without requiring elevated privileges. Unlike [`sekurlsa::tickets`](broken://pages/IO8GXhARQ2Z2WXRHALtu), this module does not interact with LSASS
* [`kerberos::ptc`](broken://pages/MbOQMnI9L3N9nOcWSQ9o) can be used to [pass the cache](https://www.thehacker.recipes/ad/movement/kerberos/ptc). This is similar to [`kerberos::ptt`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/ptt.md) that does pass the ticket but is different in the sense that the ticket used is a `.ccache` ticket instead of a `.kirbi` one
* [`kerberos::ptt`](broken://pages/DVY9ed8mxRFQ7vlpzJmq) is used for [passing the ticket](https://www.thehacker.recipes/ad/movement/kerberos/ptt) by injecting one or may Kerberos tickets in the current session. The ticket can either be a TGT (Ticket-Granting Ticket) or an ST (Service Ticket)
* [`kerberos::purge`](broken://pages/8IBCg24dQCGm7hPVGoWW) purges all kerberos tickets similar to [`klist purge`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist)
* [`kerberos::tgt`](broken://pages/8g0OkSoVOEOAJ8v9a2fT) retrieves a TGT (Ticket-Granting Ticket) for the current user

### lsadump

* [`lsadump::backupkeys`](broken://pages/uIEwTKiArwEKBFLwhmkD) dumps the DPAPI backup keys from the Domain Controller (cf. [dumping DPAPI secrets](https://www.thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secrets))
* [`lsadump::cache`](broken://pages/dlEGQ8HSlzYP2H7VyuMP) can be used to enumerate Domain Cached Credentials from registry. It does so by acquiring the `SysKey` to decrypt `NL$KM` (binary protected value) and then `MSCache(v1/v2)`
* [`lsadump::changentlm`](broken://pages/gjvoZgjSwLzAOvfmlNBs) can be used to change the password of a user
* [`lsadump::dcshadow`](broken://pages/NyDbMYuH0bhIGGY2xx2Y) TODO
* [`lsadump::dcsync`](broken://pages/v2nHuyJVr3qHPDKKLvRG) can be used to do a [DCSync](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync) and retrieve domain secrets. This command uses the Directory Replication Service Remote protocol ([MS-DRSR](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN)) to request from a domain controller to synchronize a specified entry
* [`lsadump::lsa`](broken://pages/n3XF4Vp0dcB235RGuXgA) extracts hashes from memory by asking the LSA server. The `patch` or `inject` takes place on the fly
* [`lsadump::mbc`](broken://pages/Pd7EnC1j1O3MEt9qduec) dumps the Machine Bound Certificate. Devices on which Credential Guard is enabled are using Machine Bound Certificates
* [`lsadump::netsync`](broken://pages/1KEROPrtWs2kAmWCGG7U) can be used to act as a Domain Controller on a target by doing a [Silver Ticket](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets#silver-ticket). It then leverages the [Netlogon](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f) to request the RC4 key (i.e. NT hash) of the target computer account
* [`lsadump::packages`](broken://pages/0azbAS0KegtRqZMAVung) lists the available Windows authentication mechanisms
* [`lsadump::postzerologon`](broken://pages/HBM0tYobHOMMfZVm6qwt) is a procedure to update AD domain password and its local stored password remotely mimic `netdom resetpwd`
* [`lsadump::RpData`](broken://pages/PH6ani60tV7Wza3IG3vx) can retrieve private data (*at the time of writing, Nov 1st 2021, we have no idea what this does or refers to* :man\_shrugging:)
* [`lsadump::sam`](broken://pages/0gBlVgQPFXksd44tsk5J) dumps the local Security Account Manager (SAM) NT hashes (cf. [SAM secrets dump](https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets))
* [`lsadump::secrets`](broken://pages/enBlNNCSZqeEQI8Vwz5o) can be used to [dump LSA secrets](https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets) from the registries. It retrieves the `SysKey` to decrypt `Secrets` entries
* [`lsadump::setntlm`](broken://pages/5Hhi9KdkF6fu7IqqgkQC) can be used to perform a password reset without knowing the user's current password. It can be useful during an active directory [Access Control (ACL) abuse](https://www.thehacker.recipes/ad/movement/access-controls) scenario
* [`lsadump::trust`](broken://pages/8YUhWS8M2xuEF3mM4tga) can be used for dumping the forest trust keys. Forest trust keys can be leveraged for forging inter-realm trust tickets. Since most of the EDRs are paying attention to the KRBTGT hash, this is a stealthy way to compromise forest trusts
* [`lsadump::zerologon`](broken://pages/HyVSNh1HNnodHrFhqnXg) detects and exploits the [ZeroLogon](https://www.thehacker.recipes/ad/movement/netlogon/zerologon) vulnerability

### misc

* [`misc::aadcookie`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/aadcookie.md) can be used to dump the Azure Panel's session cookie from `login.microsoftonline.com`
* [`misc::clip`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/clip.md) monitors clipboard. `CTRL+C` stops the monitoring
* [`misc::cmd`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/cmd.md) launches the command prompt
* [`misc::compress`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/compress.md) performs a self compression of mimikatz
* [`misc::detours`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/detours.md) is experimental and it tries to enumerate all modules with [Detours-like hooks](https://www.codeproject.com/Articles/30140/API-Hooking-with-MS-Detours)
* [`misc::efs`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/efs.md) is Mimikatz's implementation of the [MS-EFSR abuse (PetitPotam)](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-efsr), an authentication coercion technique
* [`misc::lock`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/lock.md) locks the screen. It can come in handy with [`misc::memssp`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/memssp.md)
* [`misc::memssp`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/memssp.md) patches LSASS by injecting a new Security Support Provider (a DLL is registered)
* [`misc::mflt`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/mflt.md) identifies Windows minifilters inside mimikatz, without using **fltmc.exe**. It can also assist in fingerprinting security products, by altitude too (Gathers details on loaded drivers, including driver altitude)
* [`misc::ncroutemon`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/ncroutemon.md) displays Juniper network connect (without route monitoring)
* [`misc::ngcsign`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/ngcsign.md) can be used to dump the NGC key (Windows Hello keys) signed with the symmetric pop key.
* [`misc::printnightmare`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/printnightmare.md) can be used to exploit the [PrintNightMare](https://adamsvoboda.net/breaking-down-printnightmare-cve-2021-1675/) vulnerability in both \[[MS-RPRN RpcAddPrinterDriverEx](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/b96cc497-59e5-4510-ab04-5484993b259b)] and \[[MS-PAR AddPrinterDriverEx](https://docs.microsoft.com/en-us/windows/win32/printdocs/addprinterdriverex)]. The bug was discovered by Zhiniang Peng ([@edwardzpeng](https://twitter.com/edwardzpeng?lang=en)) & Xuefeng Li ([@lxf02942370](https://twitter.com/lxf02942370?lang=en))
* [`misc::regedit`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/regedit.md) launches the registry editor
* [`misc::sccm`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/sccm.md) decrypts the password field in the `SC_UserAccount` table in the SCCM database
* [`misc::shadowcopies`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/shadowcopies.md) is used to list the available shadow copies on the system
* [`misc::skeleton`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/skeleton.md) injects a "[Skeleton Key](https://www.thehacker.recipes/ad/persistence/skeleton-key)" into the LSASS process on the domain controller
* [`misc::spooler`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/spooler.md) is Mimikat's implementation of the [MS-RPRN abuse (PrinterBug)](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-rprn), an authentication coercion technique
* [`misc::taskmgr`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/taskmgr.md) launches the task manager
* [`misc::wp`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/wp.md) sets up a wallpaper
* [`misc::xor`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/xor.md) performs XOR decoding/encoding on a provided file with `0x42` default key

### net

* [`net::alias`](broken://pages/-MkacaS5p5Tqwq6HjwwT) displays more information about the local group memberships including Remote Desktop Users, Distributed COM Users, etc
* [`net::deleg`](broken://pages/-Mkb06rDUF0M503cjCsv) checks for the following types of [Kerberos delegations](https://www.thehacker.recipes/ad-ds/movement/kerberos/delegations)
* [`net::group`](broken://pages/-MkabAcMUWgpo76WEHKY) displays the local groups
* [`net::if`](broken://pages/-MkbXUsfTx8A_3e7zscc) displays the available local IP addresses and the hostname
* [`net::serverinfo`](broken://pages/-MkapgQMAeoe7j8EOfbB) displays information about the logged in server
* [`net::session`](broken://pages/-MkadN1qXTK0CuoZff8e) displays the active sessions through [NetSessionEnum()](https://web.archive.org/web/20201201223201/https://docs.microsoft.com/en-us/windows/win32/api/lmshare/nf-lmshare-netsessionenum) Win32 API function
* [`net::share`](broken://pages/-MkaoV5ZXtuaagvD1M4D) displays the available shares
* [`net::stats`](broken://pages/-MkanFe78ww9e3Cf3ASP) displays when the target was booted
* [`net::tod`](broken://pages/-MkaivQht_iD8A5ZAwyn) displays the current time
* [`net::trust`](broken://pages/-MkauI11Z0hHrAgXuRRi) displays information for the active directory forest trust(s)
* [`net::user`](broken://pages/-Mkaax2BC_ijMrBQalnD) displays the local users
* [`net::wsession`](broken://pages/-Mkai8e0lpzYRgUjwaa4) displays the active sessions through [NetWkstaUserEnum()](https://web.archive.org/web/20190909155552/https://docs.microsoft.com/en-us/windows/win32/api/lmwksta/nf-lmwksta-netwkstauserenum) Win32 API function

### privilege

* [`privilege::backup`](broken://pages/-Ml-VP9d31uAbO3KvM6g) requests the backup privilege (`SeBackupPrivilege`)
* [`privilege::debug`](broken://pages/-Ml-VKXGIFFeu898jTtD) requests the debug privilege (`SeDebugPrivilege`)
* [`privilege::driver`](broken://pages/-Ml-VYVAlIt5atsG1-Sf) requests the load driver privilege (`SeLoadDriverPrivilege`)
* [`privilege::id`](broken://pages/-Ml-VzweuxOX_dxy5TCt) requests a privilege by its `id`
* [`privilege::name`](broken://pages/-Ml-WWv4jvcZwUtKGEwL) requests a privilege by its name
* [`privilege::restore`](broken://pages/-Ml-VTIHO4ZVUyl63ylo) requests the restore privilege (`SeRestorePrivilege`)
* [`privilege::security`](broken://pages/-Ml-VW5GA_OXG1Dtzvru) requests the security privilege (`SeSecurityPrivilege`)
* [`privilege::sysenv`](broken://pages/-Ml-WUC2GEaa_Hky4vO-) requests the system environment privilege (`SeSystemEnvironmentPrivilege`)
* [`privilege::tcb`](broken://pages/-Ml-VN3lYhxoMvnGDKAx) requests the tcb privilege (`SeTcbPrivilege`)

### process

* [`process::exports`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/exports.md) lists all the exported functions from the DLLs each running process is using. If a\*\* \*\*`/pid` is not specified, then exports for `mimikatz.exe` will be displayed
* [`process::imports`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/imports.md) lists all the imported functions from the DLLs each running process is using. If a\*\* \*\*`/pid` is not specified, then imports for `mimikatz.exe` will be displayed
* [`process::list`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/list.md) lists all the running processes. It uses the [NtQuerySystemInformation](https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntquerysysteminformation) Windows Native API function
* [`process::resume`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/resume.md) resumes a suspended process by using the [NtResumeProcess](https://www.geoffchappell.com/studies/windows/win32/ntdll/api/native.htm) Windows Native API function
* [`process::run`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/run.md) creates a process by using the [CreateProcessAsUser](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera) Win32 API function. The [CreateEnvironmentBlock](https://docs.microsoft.com/en-us/windows/win32/api/userenv/nf-userenv-createenvironmentblock) is also utilized
* [`process::runp`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/runp.md) runs a subprocess under a parent process (Default parent process is `LSASS.exe`). It can also be used for lateral movement and process spoofing
* [`process::start`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/start.md) starts a process by using the [CreateProcess](https://web.archive.org/web/20170713150625/https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425.aspx) Win32 API function. The `PID` of the process is also displayed
* [`process::stop`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/stop.md) terminates a process by using the [NtTerminateProcess](https://www.geoffchappell.com/studies/windows/win32/ntdll/api/native.htm) Windows Native API function. The Win32 API equal one is [TerminateProcess](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-terminateprocess)
* [`process::suspend`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/suspend.md) suspends a process by using the [NtSuspendProcess](https://ntopcode.wordpress.com/tag/ntsuspendprocess/) Windows Native API function

### rpc

* [`rpc::close`](broken://pages/-MkXHCqmUbaQ08KE63OO) closes remote RPC sessions
* [`rpc::connect`](broken://pages/-MkXDRfKqtJ81nIcYvOB) connects to an RPC endpoint
* [`rpc::enum`](broken://pages/-MkXImnMVuBIQiDGx6pf) enumerates RPC endpoints on a system
* [`rpc::server`](broken://pages/-MkXCy-t49SRlXkUjfiY) starts an RPC server

### sekurlsa

* [`sekurlsa::backupkeys`](broken://pages/9ZuC4dcjD5mP90bVBHVv) lists the preferred Backup Master keys
* [`sekurlsa::bootkey`](broken://pages/y5d5HyeoqheJEo486kYo) sets the SecureKernel Boot Key and attempts to decrypt LSA Isolated credentials
* [`sekurlsa::cloudap`](broken://pages/aLJ6se75NasFM8YaqUOf) lists Azure (Primary Refresh Token) credentials based on the following research: [Digging further into the Primary Refresh Token](https://dirkjanm.io/digging-further-into-the-primary-refresh-token/). [According to Benjamin](https://twitter.com/gentilkiwi/status/1291102498099527682?s=20):
* [`sekurlsa::credman`](broken://pages/kz0gWaZSbkKx4rzFiWyM) lists Credentials Manager by targeting the Microsoft Local Security Authority Server DLL ([lsasrv.dll](https://windows10dll.nirsoft.net/lsasrv_dll.html))
* [`sekurlsa::dpapi`](broken://pages/7YiHDUVZ3ERAEd0QZqQB) lists DPAPI cached masterkeys
* [`sekurlsa::dpapisystem`](broken://pages/UwdzKYKa1lyHX9xh7Rgq) lists the `DPAPI_SYSTEM` secret key
* [`sekurlsa::ekeys`](broken://pages/h12FLFtCgsr4lrHa37Ir) lists Kerberos encryption keys
* [`sekurlsa::kerberos`](broken://pages/1FRewTb5g92sEcES7kmA) lists Kerberos credentials
* [`sekurlsa::krbtgt`](broken://pages/3qkx4iDIDOsqDvaZwQmO) retrieves the krbtgt RC4 (i.e. NT hash), AES128 and AES256 hashes
* [`sekurlsa::livessp`](broken://pages/W5SUGRpsee8aR1tI4ZS1) lists LiveSSP credentials. According to Microsoft, the LiveSSP provider is included by default in Windows 8 and later and is included in the Office 365 Sign-in Assistant
* [`sekurlsa::logonpasswords`](broken://pages/XYfeDv8JS9zn241cvb4e) lists all available provider credentials. This usually shows recently logged on user and computer credentials
* [`sekurlsa::minidump`](broken://pages/GPnd66A5OsK4Kyo9rrrQ) can be used against a dumped LSASS process file and it does not require administrative privileges. It's considered as an "offline" dump
* [`sekurlsa::msv`](broken://pages/ZUktkcw1Dtcjw7kMjGR0) dumps and lists the NT hash (and other secrets) by targeting the [MSV1\_0 Authentication Package](https://docs.microsoft.com/en-us/windows/win32/secauthn/msv1-0-authentication-package)
* [`sekurlsa::process`](broken://pages/7ziM9ygVUXs6eccrvrls) switches (or reinits) to LSASS process context. It can be used after [`sekurlsa::minidump`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/minidump.md)
* [`sekurlsa::pth`](broken://pages/zE0gnAsyhFmQAEHzRgZ3) performs [Pass-the-Hash](https://www.thehacker.recipes/ad/movement/ntlm/pth), [Pass-the-Key](https://www.thehacker.recipes/ad/movement/kerberos/ptk) and [Over-Pass-the-Hash](https://www.thehacker.recipes/ad/movement/kerberos/opth). Upon successful authentication, a program is run (n.b. defaulted to `cme.exe`)
* [`sekurlsa::ssp`](broken://pages/Qr6ZmjXRBgL7NzqzOcaq) lists [Security Support Provider](https://docs.microsoft.com/en-us/windows-server/security/windows-authentication/security-support-provider-interface-architecture) (SSP) credentials
* [`sekurlsa::tickets`](broken://pages/IO8GXhARQ2Z2WXRHALtu) lists Kerberos tickets belonging to all authenticated users on the target server/workstation. Unlike [`kerberos::list`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/process/list.md), sekurlsa uses memory reading and is not subject to key export restrictions. Sekurlsa can also access tickets of others sessions (users)
* [`sekurlsa::trust`](broken://pages/TfJD3Z3sYjlH6HzZkqtU) retrieves the forest trust keys
* [`sekurlsa::tspkg`](broken://pages/J4EFsUz5hTQlMC0wmqrF) lists TsPkg credentials. This credentials provider is used for Terminal Server Authentication
* [`sekurlsa::wdigest`](broken://pages/sQQFnIDDwvhqHpoFjOt1) lists WDigest credentials. According to Microsoft, [WDigest.dll](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc778868\(v%3dws.10\)) was introduced in the Windows XP operating system

### service

* [`service::-`](broken://pages/-Ml-3VNUVAtxSqExykPT) removes the `mimikatzsvc` service
* [`service::+`](broken://pages/-MkwXraOAaB02ZnTJt6Z) installs the `mimikatzsvc` service by issuing `rpc::server service::me exit`
* [`service::preshutdown`](broken://pages/-MkwRu5jQuFJ4JYiaeLR) pre-shuts down a specified service by sending a `SERVICE_CONTROL_PRESHUTDOWN` signal
* [`service::remove`](broken://pages/-MkwIV9rn3I6dlJoz177) removes the specified service (It must be used with caution)
* [`service::resume`](broken://pages/-MkwRpDvr_rsD1vsEy0c) resumes a specified service, after successful suspending, by sending a `SERVICE_CONTROL_CONTINUE` signal
* [`service::shutdown`](broken://pages/-MkwRriR5P94zRKCAdJA) shuts down a specified service by sending a `SERVICE_CONTROL_SHUTDOWN` signal
* [`service::start`](broken://pages/-MkwF9P7jhy3G_0LSWU0) starts a service
* [`service::stop`](broken://pages/-MkwHYFmYRJELkoBPFy7) stops a specified service by sending a `SERVICE_CONTROL_STOP` signal
* [`service::suspend`](broken://pages/-MkwItqw1VU28kjwt0vB) suspends the specified service. It sends a `SERVICE_CONTROL_PAUSE` signal

### sid

* [`sid::add`](broken://pages/-MkX1QI88uU4MPjxGsS2) adds a SID to `sIDHistory` of an object
* [`sid::clear`](broken://pages/-MkX7CkOL8f74Wvg1mnt) clears the `sIDHistory` of a target object
* [`sid::lookup`](broken://pages/-MkWp-yQ6O5U-EYTqRz_) looks up an object by its SID or name
* [`sid::modify`](broken://pages/pP6mRYaFFutsFiyYZGMe) modifies an object's SID
* [`sid::patch`](broken://pages/-MkWuBBRQId6B6Oc_SlA) patchs the NTDS (NT Directory Services). It's useful when running [`id::modify`](broken://pages/pP6mRYaFFutsFiyYZGMe) or [`sid::add`](broken://pages/-MkX1QI88uU4MPjxGsS2)
* [`sid::query`](broken://pages/-MkWrlO863s5VNoPnyU0) queries an object by its SID or name

### standard

* [`standard::answer`](broken://pages/FXuepKN6ChuUWKVJSxgy) or `answer` provides an answer to [The Ultimate Question of Life, the Universe, and Everything!](https://hitchhikers.fandom.com/wiki/Ultimate_Question) :stars:
* [`standard::base64`](broken://pages/zs6ptgR2eUohUpgSGAIM) or `base64` switches file input/output to base64
* [`standard::cd`](broken://pages/BUrzLNr91QyET58EozNv) or `cd` can change or display the current directory. The changed directory is used for saving files
* [`standard::cls`](broken://pages/7ctYb5wMaPOHJjTookqz) or `cls` clears the screen
* [`standard::coffee`](broken://pages/gR1OasJp3perBEzZ2YwU) or `coffee` is the most important command of all
* [`standard::exit`](broken://pages/El9zguBQVfX6guqK6mxC) or `exit` quits Mimikatz after clearing routines
* [`standard::hostname`](broken://pages/M9xrlw5gZfcFWTpK0UxS) or `hostname` displays system local hostname
* [`standard::localtime`](broken://pages/JC2XFtYEC2Fwbnp37zdI) or `localtime` displays system local date and time
* [`standard::log`](broken://pages/BXaiJIoWZu9EvaWwBOs2) or `log` logs mimikatz input/output to a file
* [`standard::sleep`](broken://pages/tTO9PJlTF3fHgI21mQ62) or `sleep` make Mimikatz sleep an amount of milliseconds
* [`standard::version`](broken://pages/uLckOFbNfJWQAOTsGXaI) or `version` displays the version in use of Mimikatz

### token

* [`token::elevate`](broken://pages/-MkcxSBEg83NwwITy0ZV) can be used to impersonate a token. By default it will elevate permissions to `NT AUTHORITY\SYSTEM`
* [`token::list`](broken://pages/-MkbzjnpMoPY4te4T880) lists all tokens on the system
* [`token::revert`](broken://pages/-Mkd1dhO0Cs8S68PTJ62) reverts to the previous token
* [`token::run`](broken://pages/-Mkd3AqiQsQtdOTfIPoD) executes a process with its token
* [`token::whoami`](broken://pages/-Mkbz3vW7QBQYNfgAygL) displays the current token

### ts

* [`ts::logonpasswords`](broken://pages/-MkVyIV7nnTn_nGftqqK) extracts clear text credentials from RDP running sessions (server side)
* [`ts::mstsc`](broken://pages/-MkW6Gar81MRFmBZ8FOS) extracts cleartext credentials from the mstsc process (client side)
* [`ts::multirdp`](broken://pages/-MkRghWe1967cFWmx--4) enables multiple RDP connections on the target server
* [`ts::remote`](broken://pages/-MkS-zREcIV-D24tQmWi) performs RDP takeover/hijacking of active sessions
* [`ts::sessions`](broken://pages/-MkRs3nziTig1DBqZRsV) lists the current RDP sessions. It comes in handy for RDP hijacking

### vault

* [`vault::cred`](broken://pages/XMNgAq8g76YEAcDrfJQO) enumerates vault credentials
* [`vault::list`](broken://pages/UUpmQJ1kZrrhh0bIJmnQ) lists saved credentials in the Windows Vault such as scheduled tasks, RDP, Internet Explorer for the current user

credits - <https://tools.thehacker.recipes/mimikatz/modules>