{"id":"T1003.005","name":"Cached Domain Credentials","url":"https://attack.mitre.org/techniques/T1003/005","tactics":["credential-access"],"platforms":["Windows","Linux"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0513","stix_id":"x-mitre-detection-strategy--90b5ad4f-44bf-46e2-ac66-6e81e573e3fb","name":"Detection of Cached Domain Credential Dumping via Local Hash Cache Access","url":"https://attack.mitre.org/detectionstrategies/DET0513","analytics":[{"id":"AN1417","stix_id":"x-mitre-analytic--18ba26d6-08e0-4370-8ef0-b2dd73bfe0b3","name":"Analytic 1417","description":"Detects adversary behavior accessing Windows cached domain credential files using tools like Mimikatz, reg.exe, or PowerShell, often combined with registry exports or LSASS memory scraping.","url":"https://attack.mitre.org/detectionstrategies/DET0513#AN1417","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TargetFilename","description":"Location of cached credential files may vary with OS version or custom registry hive exports."},{"field":"CommandLine","description":"Patterns for reg save, secretsdump, or PowerShell dumping tools may be tuned to org-specific tooling."},{"field":"TimeWindow","description":"Temporal correlation window between process execution and registry/file access."}],"live":true,"detection_strategies":["DET0513"],"techniques":["T1003.005"]},{"id":"AN1418","stix_id":"x-mitre-analytic--26940057-e464-49f9-8f76-ceaca4b9d982","name":"Analytic 1418","description":"Detects access to SSSD or Quest VAS cached credential databases using tdbdump or other file access patterns, requiring sudo/root access.","url":"https://attack.mitre.org/detectionstrategies/DET0513#AN1418","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"file","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:EXECVE","channel":"EXECVE","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"},{"name":"linux:osquery","channel":"process_events","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"filepath","description":"SSSD and Quest cache paths differ by deployment and OS variant."},{"field":"CommandLine","description":"Tunable to capture specific tools (e.g., tdbdump, cat) or scripts accessing cache files."},{"field":"TimeWindow","description":"Time between elevation and file access can be adjusted to account for legitimate system behavior."}],"live":true,"detection_strategies":["DET0513"],"techniques":["T1003.005"]}],"live":true,"version":"1.0","techniques":["T1003.005"]}],"sigma_rules":[{"id":"07f8bdc2-c9b3-472a-9817-5a670b872f53","title":"Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE","author":"jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2019-01-16","modified":"2024-03-05","description":"Detects usage of cmdkey to look for cached credentials on the system","references":["https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation","https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx","https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.005"],"path":"rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml","techniques":["T1003.005"],"cves":[]},{"id":"4976aa50-8f41-45c6-8b15-ab3fc10e79ed","title":"Credential Dumping Tools Service Execution - System","author":"Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community","status":"test","level":"high","date":"2017-03-05","modified":"2022-11-29","description":"Detects well-known credential dumping tools execution via service execution events","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"windows","service":"system"},"tags":["attack.credential-access","attack.execution","attack.t1003.001","attack.t1003.002","attack.t1003.004","attack.t1003.005","attack.t1003.006","attack.t1569.002","attack.s0005"],"path":"rules/windows/builtin/system/service_control_manager/win_system_mal_creddumper.yml","techniques":["T1003.001","T1003.002","T1003.004","T1003.005","T1003.006","T1569.002"],"cves":[]},{"id":"8fbf3271-1ef6-4e94-8210-03c2317947f6","title":"Cred Dump Tools Dropped Files","author":"Teymur Kheirkhabarov, oscd.community","status":"test","level":"high","date":"2019-11-01","modified":"2025-10-25","description":"Files with well-known filenames (parts of credential dump software or files produced by them) creation","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1003.001","attack.t1003.002","attack.t1003.003","attack.t1003.004","attack.t1003.005"],"path":"rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml","techniques":["T1003.001","T1003.002","T1003.003","T1003.004","T1003.005"],"cves":[]},{"id":"961d0ba2-3eea-4303-a930-2cf78bbfcc5e","title":"HackTool - Credential Dumping Tools Named Pipe Created","author":"Teymur Kheirkhabarov, oscd.community","status":"test","level":"critical","date":"2019-11-01","modified":"2023-08-07","description":"Detects well-known credential dumping tools execution via specific named pipe creation","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment","https://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.credential-access","attack.t1003.001","attack.t1003.002","attack.t1003.004","attack.t1003.005"],"path":"rules/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml","techniques":["T1003.001","T1003.002","T1003.004","T1003.005"],"cves":[]},{"id":"a642964e-bead-4bed-8910-1bb4d63e3b4d","title":"HackTool - Mimikatz Execution","author":"Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton","status":"test","level":"high","date":"2019-10-22","modified":"2023-02-21","description":"Detection well-known mimikatz command line arguments","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment","https://tools.thehacker.recipes/mimikatz/modules"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.001","attack.t1003.002","attack.t1003.004","attack.t1003.005","attack.t1003.006"],"path":"rules/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml","techniques":["T1003.001","T1003.002","T1003.004","T1003.005","T1003.006"],"cves":[]},{"id":"b1ec66c6-f4d1-4b5c-96dd-af28ccae7727","title":"New Generic Credentials Added Via Cmdkey.EXE","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-03","modified":"2024-03-05","description":"Detects usage of \"cmdkey.exe\" to add generic credentials.\nAs an example, this can be used before connecting to an RDP session via command line interface.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.005"],"path":"rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds.yml","techniques":["T1003.005"],"cves":[]},{"id":"f0d1feba-4344-4ca9-8121-a6c97bd6df52","title":"Credential Dumping Tools Service Execution - Security","author":"Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community","status":"test","level":"high","date":"2017-03-05","modified":"2022-11-29","description":"Detects well-known credential dumping tools execution via service execution events","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.execution","attack.t1003.001","attack.t1003.002","attack.t1003.004","attack.t1003.005","attack.t1003.006","attack.t1569.002","attack.s0005"],"path":"rules/windows/builtin/security/win_security_mal_creddumper.yml","techniques":["T1003.001","T1003.002","T1003.004","T1003.005","T1003.006","T1569.002"],"cves":[]},{"id":"fd877b94-9bb5-4191-bb25-d79cbd93c167","title":"Dumping of Sensitive Hives Via Reg.EXE","author":"Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113","status":"test","level":"high","date":"2019-10-22","modified":"2023-12-13","description":"Detects the usage of \"reg.exe\" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment","https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md","https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.002","attack.t1003.004","attack.t1003.005","car.2013-07-001"],"path":"rules/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml","techniques":["T1003.002","T1003.004","T1003.005"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}