Benjamin Delpy
- Created mimikatz in 2011, demonstrating how Windows stored credentials in memory
- Documented Kerberos ticket attacks including golden and silver tickets
- Maintains the tool against each generation of Windows credential defenses
Bio
Benjamin Delpy, who publishes as gentilkiwi, wrote mimikatz in 2011 after finding that Windows held both an encrypted copy of a password and the key to decrypt it in memory at the same time. Microsoft's initial response was that exploiting it required an already-compromised machine. He published the tool, and the industry's understanding of credential theft changed.
Profile built from public project, vendor, and press records. Included as a researcher whose published work reshaped defensive practice; this is not an endorsement of any use of the tool.
Where their work shows up
Almost every defensive control now considered standard in a Windows environment exists because mimikatz made the attack undeniable: Credential Guard, LSA protection, tiered administration, disabling WDigest, and the whole practice of treating a domain controller as a crown jewel. It also made Kerberoasting, pass-the-hash style credential reuse, and Kerberos delegation abuse teachable rather than theoretical. See the ITDR guide and the best ITDR for Active Directory ranking.
Related on Start with Identity
- GlossaryNTLM
A challenge-response authentication protocol used by Windows before Kerberos and still present as a fallback. The client proves knowledge of a password hash wit
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- GlossaryActive Directory
Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- GlossaryIdentity Resilience
The ability to keep authenticating and authorising legitimate users, and to recover the identity system itself, when the identity provider or directory is degra