Mimic home
Products
Ransomware DefenseAI GuardrailsAgentic AI GovernanceVirtual Patching
Resources
Resources HubBlogWhitepapersWhen Detection Becomes the Build TriggerActive Directory SecurityLateral MovementFileless AttacksZero-Day DefenseAI-Powered RansomwareThe Patch WindowCase StudiesKnown-Good Enforcement Glossary
Research
The Server Threat LibraryThe Exploit PathMissing Patches
Company
AboutCareersEventsIn the News
Book a Demo
Solutions/
Admin tools and valid credentials

Use case

Stop attackers who use valid credentials and admin tools.

Stop an attacker with valid credentials by checking what the session changes, not who logged in. Stolen credentials and admin tools such as PowerShell remoting pass authentication. Mimic Networks checks each change to a protected server against its known-good profile, so an unauthorized change stops at the point of execution even when an administrator account makes it.

Book a demo
October 27, 2026

What Mimic does

What Mimic does on the server.

Check the change, not the login.

Mimic asks whether the change was authorized, not who made it. An administrator account that changes a protected file, service or registry key outside the server's known-good profile stops at the point of execution.

Ransomware Defense

Hold admin tools to the profile.

Remote administration tools such as PowerShell remoting pass authentication, and Mimic doesn't need to block the tool. A change it pushes to a protected server outside that server's known-good profile stops at the point of execution.

Ransomware Defense

Undo the group change attackers make first.

With protections turned on, Mimic reverts protected group membership changes automatically, in seconds to minutes. The Mimic-protected groups are nine built-in groups, Domain Admins among them, plus any group you add.

Ransomware Defense

The session passed authentication. The change still has to pass the profile.An administrator session with valid credentials tries four changes on a protected server. Each meets the server's known-good profile check. Changes in the profile proceed; changes outside it stop at the point of execution, and DashCam records each attempt. SOURCE Admin session with valid credentials ATTEMPT 01 Change a protected service ATTEMPT 02 Edit a protected registry key ATTEMPT 03 Write a new executable ATTEMPT 04 Push a change over PowerShell remoting Known-good profile check Was this change authorized? INSIDE THE PROFILE In the profile: proceeds OUTSIDE THE PROFILE Outside it: stopped at the point of execution DASHCAM RECORDS EACH ATTEMPT
The session passed authentication. The change still has to pass the profile.An administrator session with valid credentials tries four changes on a protected server. Each meets the server's known-good profile check. Changes in the profile proceed; changes outside it stop at the point of execution, and DashCam records each attempt. SOURCE Admin session with valid credentials ATTEMPT 01 Change a protected service ATTEMPT 02 Edit a protected registry key ATTEMPT 03 Write a new executable ATTEMPT 04 Push a change over PowerShell remoting Known-good profile check Was this change authorized? INSIDE THE PROFILE In the profile: proceeds OUTSIDE THE PROFILE Outside it: stopped at the point of execution DASHCAM RECORDS EACH ATTEMPT
The session passed authentication. The change still has to pass the profile.

Questions

Can you stop ransomware that spreads with PowerShell remoting?

Mimic stops the change it tries to make. PowerShell remoting passes authentication, so the session itself looks legitimate. When it tries to change a protected server outside the server's known-good profile, Mimic stops that change at the point of execution, and DashCam records the process that started it.

What about insiders?

An insider with valid credentials meets the same check as an outside attacker with stolen ones. Mimic checks what a change does to a protected server, not who asked for it. A change outside the known-good profile stops at the point of execution and lands in DashCam with the process behind it.

Doesn't MFA already stop this?

MFA decides who gets a session. Once the session is open, through a stolen token, a phished approval or a real administrator, MFA has done its job. Mimic checks what that session tries to change on a protected server, so the two controls answer different questions.

Proof

How you'll see it work.

DashCam records each blocked attempt: what it tried to change, when and the process behind it. That's the record your team reads after a test, or after an intrusion.

Limits

Where Mimic stops.

  • Mimic Networks protects Windows Server 2016 and later, and Red Hat Enterprise Linux 8 and later.
  • It doesn't run on laptops, desktops or network devices.
  • In Maintenance Mode, Mimic suspends enforcement and keeps monitoring.
  • Mimic doesn't decide who can sign in. Identity controls, MFA and privileged access tools still do that.
  • Mimic constrains only the steps that need an unauthorized change. An attacker reading data through access the account already has isn't stopped.

Who it's for

For your role.

Security operations

An intrusion with valid credentials looks like normal administration in the logs. Mimic feeds enforcement events to your SIEM and SOAR platforms, so your team sees a blocked change alongside the rest of its telemetry.

How attackers move laterally

Identity and AD owners

Stolen admin rights still face the rules on each domain controller. With protections turned on, a Mimic node locks Group Policy permissions and blocks stops of critical services.

Active Directory protection

CISOs

After MFA and EDR let a session through, something still has to judge what it does. On the servers you choose to protect, Mimic is that check.

17,000 authorized-looking actions

FAQ

Frequently asked questions.

Mimic doesn't stop tools; it stops unauthorized changes. PowerShell remoting, remote management agents and scripted deployment tools all pass authentication, and Mimic doesn't need to recognize any of them. When one of them tries to change a protected server outside its known-good profile, Mimic stops that change at the point of execution and DashCam records the process behind it.

With protections turned on, Mimic reverts protected group membership changes automatically, in seconds to minutes. Domain Admins is one of nine built-in Mimic-protected groups, and you can add your own. The change is recorded, so your team sees the membership change and when it happened instead of finding a new administrator days later.

No. They answer different questions. A privileged access tool decides who gets elevated rights and records the session. Mimic checks what that session changes on a protected server and stops unauthorized changes at the point of execution. A stolen or misused privileged session still meets that check, which is the case access controls alone don't reach.

Not on its own. Mimic constrains the steps that need an unauthorized change, such as writing a new executable, launching a process outside the profile or modifying protected configuration. An attacker who reads data through access the account already has isn't making a change, so that read proceeds. Data loss prevention and access reviews still cover that path.

Related

Keep reading.

See it on your servers.

Start with a demo. Bring the servers you need to protect and the questions your team will ask.

Book a demo

Stop every
unwanted change.

Book a Demo
Right arrow

Products

Ransomware DefenseAI GuardrailsAgentic AI GovernanceVirtual Patching

Resources

BlogCase StudiesEventsIn the NewsKnown-Good Enforcement GlossaryStop Ransomware Before EncryptionKernel-Level Enforcement SecurityKnown-Good EnforcementKernel-Level Enforcement GuideAI-Powered Ransomware ExplainedHow to Stop Ransomware Before EncryptionHow to Prevent AI-Powered RansomwareHow to Stop AI-Powered RansomwareAbout

Company

Careers

Legal

Terms of UseTerms and ConditionsPrivacy NoticeVulnerability Disclosure PolicyTechnical and Organizational MeasuresSubprocessorsData Processing Addendum
Thanks, we'll be in touch
Oops! Something went wrong while submitting the form.

Copyright Mimic 2026