gemma4-e2b-mimikatz-credential-theft

Gemma 4 E2B — Mimikatz & Credential Theft Expert

A QLoRA fine-tuned version of Gemma 4 E2B Instruct specialized in mimikatz & credential theft. Specialized in Windows credential theft and Mimikatz: LSASS dumping, DPAPI abuse, Golden/Silver ticket attacks, Kerberos credential harvesting, and detection/prevention.

Part of the rezaduty cybersecurity model family.

---

Expertise

• Mimikatz modules: sekurlsa, lsadump, dpapi, kerberos, crypto
• LSASS memory dumping techniques and Protected Process Light (PPL) bypass
• DPAPI master key extraction and blob decryption
• Golden Ticket and Silver Ticket creation and defense
• DCSync attack and domain credential replication
• Credential Guard, Credential Vault, and Windows Hello bypass
• Detection: ETW, Sysmon, Windows Defender Credential Guard

---

Model Details

---

Usage

from transformers import AutoTokenizer, AutoModelForCausalLM
from peft import PeftModel
import torch

base_model = "google/gemma-4-e2b-it"
adapter    = "rezaduty/gemma4-e2b-mimikatz-credential-theft"

tokenizer = AutoTokenizer.from_pretrained(adapter)
model = AutoModelForCausalLM.from_pretrained(
    base_model, torch_dtype=torch.bfloat16, device_map="auto"
)
model = PeftModel.from_pretrained(model, adapter)

messages = [
    {"role": "system", "content": [{"type": "text", "text": "You are an expert in Windows credential theft techniques and defenses. Provide deep technical answers on Mimikatz, LSASS dumping, credential harvesting, and detection/prevention strategies."}]},
    {"role": "user",   "content": [{"type": "text", "text": "Your question here"}]},
]
inputs = tokenizer.apply_chat_template(
    messages, tokenize=True, add_generation_prompt=True, return_tensors="pt"
).to(model.device)
output = model.generate(inputs, max_new_tokens=512, temperature=0.7, top_p=0.9)
print(tokenizer.decode(output[0][inputs.shape[-1]:], skip_special_tokens=True))

---

System Prompt

You are an expert in Windows credential theft techniques and defenses. Provide deep technical answers on Mimikatz, LSASS dumping, credential harvesting, and detection/prevention strategies.

---

See Also

• General cybersecurity model
• Docker & Container Security
• Kubernetes Security
• AI & LLM Security
• Cloud IAM & Terraform
• Active Directory & Red Team
• All rezaduty models