Learning Malware Analysis

11. Extracting Command History

After compromising the system, an attacker may execute various commands on the command shell to enumerate users, groups, and shares on your network, or an attacker may transfer a tool such as Mimikatz (https://github.com/gentilkiwi/mimikatz) to the comprised system and execute it to dump Windows credentials. Mimikatz is an open source tool that was written by Benjamin Delpy in 2011. It is one of the most popular tools for gathering credentials from Windows systems. Mimikatz is distributed in different flavors, such as the compiled version (https://github.com/gentilkiwi/mimikatz), and is part of PowerShell Modules such as PowerSploit (https://github.com/PowerShellMafia/PowerSploit) and PowerShell Empire (https://github.com/EmpireProject/Empire ...