mimikatz

What mimikatz does on Claude C2

AI agents invoke mimikatz to trigger actions in Claude C2. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why mimikatz is rated High

Mimikatz is a post-exploitation framework that executes code to extract plaintext passwords, hashes, and Kerberos tokens from process memory. This is an Execute-class action (runs external tool with argument-dependent effects), but severity is critical because: (1) it directly enables credential theft on any compromised system, (2) extracted credentials can be weaponized for lateral movement and privilege…

From the tool's definition Tool named 'mimikatz' that 'Run[s] Mimikatz command' - Mimikatz is a well-known credential dumping and privilege escalation tool that executes arbitrary memory manipulation commands on Windows systems.

The rule that runs mimikatz safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Claude C2, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For mimikatz, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "mimikatz": {
      "limits": [
        {
          "counter": "mimikatz_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about mimikatz