Credential Dumping Explained: Mimikatz, LSASS and Defences for CySA+

Mimikatz is the tool that made credential dumping a mainstream concern. Its author released it to demonstrate weaknesses in how Windows handled credentials in memory, and it is now a standard component of both red team toolkits and real intrusions.

This article covers what the technique is, why it works, and — the part the exams actually test — how to detect and prevent it. It is not a usage guide.

Why credentials sit in memory at all

Single sign-on is the reason. So that you are not prompted for a password every time you reach a file share, Windows keeps credential material available in the memory of the Local Security Authority Subsystem Service — LSASS.

Historically that included reversibly encrypted plaintext passwords, because the WDigest authentication protocol required them. Anyone able to read LSASS memory with sufficient privilege could recover them.

The design trade-off is the point to carry into the exam: convenience of single sign-on against the risk of credential material in memory. The mitigations below are all attempts to reduce what is there and who can read it.

What the technique yields

Password hashes for accounts that have authenticated on the machine.

Plaintext passwords where WDigest is enabled — which is why disabling it is a standard hardening step.

Kerberos tickets, which can be reused directly.

Cached domain credentials for accounts that logged in previously.

And because the hash is what authenticates in NTLM, an attacker does not need to crack anything.

The attacks this enables

These names appear on CySA+ and PenTest+ and should be recognisable.

Pass-the-hash. Authenticating with the hash itself rather than the password. Cracking is unnecessary, which is why password complexity does not defend against it.

Pass-the-ticket. Reusing a stolen Kerberos ticket to access services as that user.

Golden Ticket. With the KRBTGT account hash, an attacker forges Kerberos ticket-granting tickets for any user, including domain administrators, with arbitrary validity. This is effectively persistent domain control, and the only remedy is resetting the KRBTGT password twice.

Silver Ticket. Forging a service ticket for one specific service using that service account's hash. Narrower, and harder to detect because it never contacts a domain controller.

DCSync. Abusing replication permissions to ask a domain controller for password data directly, without touching LSASS at all.

The common thread, and the lesson: once an attacker holds credential material for a privileged account, the domain is compromised. Everything worth doing happens before that point.

Prevention

Credential Guard uses virtualisation-based security to isolate credential material so that even a process running as SYSTEM cannot read it. This is the primary modern control.

Disable WDigest so plaintext passwords are not stored in memory. Default on modern Windows, but worth verifying on upgraded systems.

Protected Process Light for LSASS, restricting which processes may open a handle to it.

Tiered administration. Never use domain administrator credentials to log into workstations. A domain admin logging into a compromised workstation leaves credential material there for the taking — this is the single most consequential operational mistake, and it defeats every technical control above.

Local Administrator Password Solution so local administrator passwords are unique per machine, preventing lateral movement from one recovered local hash.

Privileged Access Workstations for administrative work, and just-in-time administration so standing privilege does not exist to be stolen.

Multifactor authentication, which limits what a stolen hash achieves.

Detection

What a SOC should be watching for. Unusual process handle access to lsass.exe — Sysmon event ID 10 is the standard source. Creation of LSASS memory dumps. Unexpected use of debugging privileges. Authentication anomalies such as a service account logging in interactively, or a workstation account authenticating to many systems. Abnormal Kerberos ticket lifetimes or encryption types, which can indicate forged tickets. And replication requests from anything that is not a domain controller, which indicates DCSync.

EDR products detect the common variants, so attackers use obfuscated or in-memory-only loaders — which is why behavioural detection on LSASS access matters more than signatures.

What to remember

Credential dumping reads authentication material from LSASS memory, enabled by single sign-on design. Pass-the-hash means cracking is unnecessary and password complexity does not help. Golden Tickets from the KRBTGT hash give persistent domain control and require a double password reset. Credential Guard, disabling WDigest, LAPS and above all tiered administration are the defences; watch for handle access to lsass.exe.

Related reading: Kerberos · Data in use · EDR