pypykatz
Pure-Python Mimikatz: parses an LSASS dump offline on the attacker box.
A pure-Python reimplementation of Mimikatz. Its big advantage is that you don't need to run mimikatz.exe on the victim (AV flags it): you dump LSASS memory with procdump or comsvcs.dll and then process that .dmp OFFLINE from your Linux box with pypykatz, extracting NT hashes, tickets and cleartext passwords. Less noise, same loot.
Family Credential dumping & theft
Flags lsa minidump lsass.dmp
Concepts Dumping credentials from LSASS (Mimikatz), SAM & LSA Secrets Dump, DPAPI Secrets, Pass-the-Hash
Cheatsheet Credentials & run-as
Installation
pipx install pypykatzUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.