T1003.005Credential Access
Cached Domain Credentials
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable. On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash. The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
8 Sigma rules tagged T1003.005Cached Domain CredentialsT1003.0058 general rules
- HackTool - Credential Dumping Tools Named Pipe Createdcriticaltest
- Cred Dump Tools Dropped Fileshightest
- Credential Dumping Tools Service Execution - Securityhightest
- Credential Dumping Tools Service Execution - Systemhightest
- Dumping of Sensitive Hives Via Reg.EXEhightest
- HackTool - Mimikatz Executionhightest
- Potential Reconnaissance For Cached Credentials Via Cmdkey.EXEhightest
- New Generic Credentials Added Via Cmdkey.EXEmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Cached Domain Credentials
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.