Invoke-Mimikatz – Seven in One Go

PowerShell monitoring [1] is one of the measures we strongly recommend to our clients as part of every internal assessment [2]. Often, this measure is not implemented for financial reasons. In this article, I will demonstrate why it is worth investing in monitoring, using the example of an actual attack.This paper was written in 2017 as part of a research project at scip AG, Switzerland. It was initially published online at https://www.scip.ch/en/?labs.20170309 and is available in English and German. Providing our clients with innovative research for the information technology of the future is an essential part of our company culture