Standard Module Command Reference
The standard module provides utility commands that are available even without
prefixing them with standard:: on the mimikatz console. This guide documents
each command, its syntax, available flags, and the scenarios in which those
options are useful.
Tip: All flags follow mimikatz' generic
/flag[:value]or-flag[:value]
syntax. Flags are case-insensitive.
| Command | Purpose |
|---|---|
exit |
Leave mimikatz or end the current executing script. |
cls |
Clear the console buffer and move the cursor to the top. |
answer |
Print "42"—a tongue-in-cheek quick test command. |
coffee |
Display an ASCII art coffee mug. |
sleep |
Pause execution for a chosen duration. |
log |
Start or stop logging mimikatz input/output to a file. |
base64 |
Toggle Base64 interception for stdin/stdout redirection. |
version |
Display mimikatz and operating system version details. |
cd |
Show or change the current working directory. |
localtime |
Show the current local and UTC timestamps. |
hostname |
Display the host's DNS and NetBIOS names. |
standard::exitSyntax:
standard::exit [anything]
Behavior: Prints Bye! and terminates mimikatz. If an extra argument is
provided (for example, standard::exit now), mimikatz exits using a
thread-termination status code; otherwise it exits the whole process. This is
mostly relevant when mimikatz runs as a library inside another host process, so
leaving the argument empty is the typical usage.【F:mimikatz/modules/kuhl_m_standard.c†L30-L37】
standard::clsSyntax:
standard::cls
Behavior: Clears the console buffer and resets the cursor to the origin.
Useful when a long command spews output and you want a clean prompt. Be aware
that this does not work over redirected consoles such as PsExec sessions because
those environments do not expose the standard console buffer APIs that mimikatz
invokes.【F:mimikatz/modules/kuhl_m_standard.c†L39-L52】
standard::answerSyntax:
standard::answer
Behavior: Outputs 42.. This command is the answer to life, the universe and everything. It has no flags, why would it need any?.【F:mimikatz/modules/kuhl_m_standard.c†L54-L59】
standard::coffeeSyntax:
mimikatz # standard::coffee
( (
) )
.______.
| |]
\ /
`----'
Behavior: Prints an ASCII-art coffee mug.【F:mimikatz/modules/kuhl_m_standard.c†L61-L67】
standard::sleepSyntax:
standard::sleep [<milliseconds>]
Arguments:
milliseconds (positional, optional): Duration to sleep. Accepts either0x...) format. Defaults to 1000 if omitted.Why use it: Introduce a delay inside scripted command batches. For example,
sleep 5000 pauses execution for five seconds between operations when dealing
with remote services that require a cool-down period.【F:mimikatz/modules/kuhl_m_standard.c†L69-L77】
standard::logSyntax:
standard::log [<filename>] [/stop]
Arguments & Flags:
<filename> (positional, optional): Target log file. If omitted, mimikatzmimikatz.log in the current directory./stop (flag): Stops logging and closes the active log file.Why use it: Capture a transcript of every command and response for later
analysis, reporting, or evidentiary purposes. Use /stop once the capture is
complete to flush and close the file handle; otherwise mimikatz continues to
append to the log.【F:mimikatz/modules/kuhl_m_standard.c†L79-L87】【F:inc/globals.h†L38-L38】
standard::base64Syntax:
standard::base64 [/in[:on|off]] [/input[:on|off]] [/out[:on|off]] [/output[:on|off]]
Flags:
/in or /input: Toggle Base64 decoding for stdin redirection. Accepts theon, true, 1, off, false, or 0./out or /output: Toggle Base64 encoding for stdout redirection. Uses the/in.All flags are optional; omitting both simply prints the current interception
state.
Why use it: When commands are piped in/out through mediums that only support
text-safe data, turning on Base64 interception lets mimikatz transparently
decode incoming Base64 input and encode outgoing binary blobs. Switch the
options off to revert to raw binary I/O once the constraint no longer applies.
The helper enforces explicit on/off values to avoid ambiguity.
【F:mimikatz/modules/kuhl_m_standard.c†L89-L97】
【F:modules/kull_m_string.c†L298-L307】
standard::versionSyntax:
standard::version [/full] [/cab]
Flags:
/full: Queries and prints the full file version numbers of core security/cab: Packages those DLLs from %SystemRoot%\System32 into a cabinet filemimikatz_<arch>_sysfiles_<build>.cab for offline analysis.Why use it: The base command already prints mimikatz' build, the detected
Windows version, the compiler toolchain, and (on supported builds) whether
Credential Guard / Secure Kernel appear active. /full is invaluable when you
need to match module versions against known-vulnerable builds. /cab collects
all referenced binaries into a portable archive so you can inspect them on
another machine without touching the live system.【F:mimikatz/modules/kuhl_m_standard.c†L99-L204】
standard::cdSyntax:
standard::cd [<path>]
Arguments:
<path> (positional, optional): Target directory to switch to.Behavior: Without arguments, prints the current directory. With an argument,
shows the current directory (Cur:), attempts to change to the provided path,
then prints the new directory (New:) on success. Useful when navigating before
loading or dumping files.【F:mimikatz/modules/kuhl_m_standard.c†L206-L236】
standard::localtimeSyntax:
standard::localtime
Behavior: Displays the local time (including the active time zone when
available) and the corresponding UTC timestamp. Handy for correlating log times
or verifying time synchronization prior to Kerberos operations.【F:mimikatz/modules/kuhl_m_standard.c†L238-L250】
standard::hostnameSyntax:
standard::hostname
Behavior: Prints the fully qualified DNS hostname followed by the NetBIOS
hostname in parentheses. This dual display helps when scripts need both formats
(e.g., DNS names for Kerberos and NetBIOS names for legacy SMB tooling).【F:mimikatz/modules/kuhl_m_standard.c†L252-L264】【F:modules/kull_m_net.c†L43-L57】
The helper kull_m_string_args_byName is shared across mimikatz modules:
/ or - and may provide a value after : or =.on|true|1 oroff|false|0 are honored; anything else prints a guidance error.Understanding this parsing model helps craft correct command lines when combining
multiple flags on a single invocation.【F:modules/kull_m_string.c†L256-L314】