Defending Against Mimikatz

A offensive security tool developed by Benjamin Delpy in 2011 is named Mimikatz.  Mimikatz is a free tool that tries to scrape the memory of the target computer looking for the process responsible for Windows authentication(LSASS) to reveal cleartext passwords and NTLM hashes that the attacker can then use to attack other computers on the same network. The attacker can then escalate their account privilege either by authenticating with the clear text credentials they just stole or by simply passing the stolen hash.

Mimikatz has been used by nation-state attackers, the first known case being the 2011 hack of the now-defunct Dutch certificate authority DigiNotar.  The attackers issued bogus certificates for Google and used them to spy on the Gmail accounts of several hundred thousand Iranian users. Mimikatz has since been used by many malware creators to automate the spread of their worms, including the NotPetya attack and the 2017 BadRabbit ransomware outbreak. Mimikatz will likely remain an effective offensive security tool on Windows platforms for many years to come.

Mimikatz exploits Windows single sign-on (SSO) functionality to harvest credentials. Until Windows 10, Windows by default used a feature called WDigest that loads encrypted passwords into memory, but also loads the secret key to decrypt them. WDigest has been a useful feature for authenticating large numbers of users on an enterprise or government network, but also let Mimikatz exploit this feature by dumping memory and extracting the passwords.

Solution

Microsoft has reacted (somewhat slowly) to Mimikatz by publishing changes to address the security vulnerabilities identified, but you must apply the patches and recommendations below to address this security issue.

The basic procedures to address the issues identified are:

1. 1. 1. Limit administrator privileges to the smallest group possible. Even if you have thousands of user accounts, you should probably only have 2-10 administrator accounts. Start with two accounts and force users to justify any additional accounts added to the administrator group.
      2. The next thing that you should do is upgrade the schema and functional level of your forest and domain to at least 2012 R2. This domain functional level adds a fairly new group called “Protected Users”.  Along with other protections, the members of the Protected Users group cannot authenticate by using NTLM, Digest Authentication, or CredSSP. These changes provide powerful protections that make Mimikatz almost worthless.
      3. Verify KB2871997 has been installed to apply additional required security. After you install this security update, the default setting for non-protected users on Windows 7 and Windows 8 is to not force clear leaked logon session credentials. To override this default you can add the following registry dword, TokenLeakDetectDelaySecs, and set it to a recommended value of 30 seconds.

         HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\

      4. Stop storing passwords in memory by changing the “UseLogonCredential” registry setting  to ‘0’ instead of the default value of “1” and passwords are no longer available to Mimikatz .

         HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\WDigest

      5. Start monitoring your systems for unauthorized software and malware, which should help identify Mimikatz installation and activity.

You’ll have to test these changes to see what breaks, but the idea is to implement some fairly basic changes to protect your network.

Summary

Implementing these simple changes make a successful Mimikatz attack much more difficult.