Mimikatz and why Windows stopped trusting lsass.exe with plaintext
mimikatz 与 Windows 凭据保护的由来
Mimikatz, first documented in the early 2010s, is one of the most consequential pieces of Windows security tooling of the last fifteen years, not for any single exploit it used but for what it proved about how Windows handled credentials in memory.
What the tool demonstrated
Before mimikatz, it was widely assumed that the Local Security Authority Subsystem Service, lsass.exe, stored only password hashes such as LM and NTLM once a user had logged in, and that those hashes could be used for authentication replay but not recovered as the original password. Mimikatz showed this was incomplete. It demonstrated that a logged-in session's password was also present in memory in a reversibly encrypted form, decryptable with the algorithm the operating system itself used for single sign-on, which meant an attacker with sufficient privilege on the host could recover a user's actual plaintext password, not just a hash.
Why that distinction matters
A stolen hash is useful in a limited set of attacks, most notably pass-the-hash, but a recovered plaintext password is immediately useful everywhere that person has reused it, including on systems the attacker could not otherwise reach. This made credential theft from a single compromised endpoint a much larger problem than previously assumed, and it reframed lateral movement as something defenders had to assume would follow any local administrator compromise.
How Windows responded
Microsoft's response unfolded over several subsequent releases rather than a single patch. Credential Guard uses virtualisation-based security to isolate secrets in a protected memory region that even a kernel-level attacker cannot read directly. LSA Protection (RunAsPPL) marks lsass.exe as a protected process so that unsigned code cannot attach to it and dump its memory. Group Policy changes also reduced how long and how often plaintext-equivalent material was cached at all. None of these fully eliminates the risk on a machine that is already compromised at the kernel level, but together they raise the cost substantially.
Takeaway for defenders
The lasting lesson is less about mimikatz itself and more about the assumption it broke: that a system only stores hashes is a claim worth verifying rather than trusting by default. Any system handling authentication secrets in memory deserves the same scrutiny, Credential Guard and LSA Protection should be enabled on modern Windows fleets, and local administrator compromise should be treated as a credential-theft event, not just a single-host incident.
Key takeaways
- Mimikatz proved lsass.exe held reversibly encrypted plaintext-equivalent credentials, not only hashes.
- A recovered plaintext password is far more dangerous than a stolen hash because it is reusable across systems and services.
- Credential Guard and LSA Protection (RunAsPPL) were Microsoft's direct response to this class of attack.
- Local administrator compromise should be treated as a credential-theft event across the environment, not an isolated incident.
中文摘要
mimikatz 揭示了 Windows 的 lsass.exe 进程中实际保存着可逆加密的明文凭据，而非仅有哈希值，这一发现促使微软后续推出 Credential Guard 与 LSA Protection 等防护机制。
This note has been rewritten and checked for this edition; it is not a copy of the original post.