We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
HackTool:MSIL/Mimikatz!MSR
Aliases: No associated aliases
Summary
HackTool:MSIL/Mimikatz!MSR is a term used to identify the .NET framework compiled version of the Mimikatz which is a credential harvesting application. The tool works as a post-exploitation framework instead of a self-replicating malware and is used by the threat actor once they get the initial access to the compromised devices. The main function of the tool is to extract authentication materials like plaintext passwords, cryptographic hashes, and Kerberos security tickets from the Windows environment. This makes it very useful for network lateral movement, privilege escalation, and maintaining access in the enterprise infrastructure. The tool's efficacy has led to its presence in various high-profile security incidents, ranging from state espionage to sophisticated ransomware.
The development of Mimikatz has evolved over the years, and the tool has become a modular exploitation framework organized in different development branches. Its capability goes as far as having non-Windows attack vectors against Windows Auth protocols, and the recent versions are working on getting around the very common defensive measures like file-based launch and living-of-the-land. The threat actors are in a position where they can draw only what they need for the operation into the memory. This not only helps with hiding but is also possible because of the firm's control over devices against the latest Windows security measures.
- Disconnect the compromised device from all networks (both wired and Wi-Fi) as soon as possible. This severs the threat actor’s remote connection and prevents further data exfiltration.
- Conduct a comprehensive investigation to identify every compromised user and computer account, then perform mandatory password resets for these accounts and other exposed credentials.
- Reboot compromised devices to clear the malicious SSP from memory; however, for complete assurance, reimage the host operating system from a known clean backup or source.
- Perform a forensic analysis to determine the initial attack vector and apply corrective measures to patch the vulnerability and prevent re-infection.
Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
