mimikatz sekurlsa::logonpasswords

mimikatz # privilege::debug ; sekurlsa::logonpasswords

Extracts plaintext passwords and NTLM hashes from credentials in lsass.exe memory (active logon sessions).

Run it when you already have local access to a Windows host (as Administrator or SYSTEM) and want to obtain credentials from active sessions. It's the most classic and effective dumping: logged-in users, service accounts, and even domain credentials in plaintext.

If the EDR blocks process debugging or lsass is protected by PPL (Credential Guard/LSA Protection), mimikatz will fail or be detected. Avoid it on hosts where logs 4104/4688 are audited to the max and the goal is total stealth.