T1003.005 — Cached Domain Credentials

Tactic: Credential Access · Platforms: Windows, Linux

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable. On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash. The number of default…

Sub-technique of OS Credential Dumping (T1003).

Sigma detection rules (2)

T1003.005 OS Credential Dumping: Cached Domain Credentials

title: "T1003.005 OS Credential Dumping: Cached Domain Credentials"
id: eef6b4e9-6c40-4950-8600-658b1db4f94e
description: 'Detects access to the cached domain credential (DCC2) hash store via reg.exe saving the SECURITY or SAM registry hives, or via Mimikatz''s lsadump::cache module, consistent with OS Credential Dumping of Cached Domain Credentials. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TargetFilename, CommandLine, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1003/005
author: Shahrukh Khan
date: 2026-05-08
license: MIT
tags:
  - attack.credential-access
  - attack.t1003.005

logsource:
  category: process_creation
  product: windows

detection:
  selection_reg_save:
    Image|endswith: '\reg.exe'
    CommandLine|contains: 'save'
  selection_reg_hive:
    CommandLine|contains:
      - 'HKLM\SECURITY'
      - 'HKLM\SAM'
  selection_mimikatz:
    CommandLine|contains:
      - 'lsadump::cache'
      - 'lsadump::secrets'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: ((selection_reg_save and selection_reg_hive) or selection_mimikatz) and not filter_system_account

falsepositives:
  - Legitimate backup or registry-export tooling saving the SECURITY/SAM hives for disaster-recovery purposes; System and service accounts are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: high

T1003.005 OS Credential Dumping: Cached Domain Credentials

title: "T1003.005 OS Credential Dumping: Cached Domain Credentials"
id: 9bbf68f3-ef9a-4a0c-9f7b-99c2004ea9f7
description: 'Detection of Cached Domain Credential Dumping via Local Hash Cache Access. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Broadened beyond the literal cat binary to any common file-read tool or interpreter (less, more, head, tail, cp, python3, python, perl, tdbdump, strings, hexdump, xxd) accessing the SSSD cache directory, and added a filter excluding SSSD''s own maintenance/admin tooling (sssctl, sss_cache, sssd, sssd_be, sssd_nss, sssd_pam) to avoid alerting on the daemon''s legitimate access to its own cache. Tune using: filepath, CommandLine, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1003/005
author: Shahrukh Khan
date: 2026-05-29
license: MIT
tags:
  - attack.credential-access
  - attack.t1003.005

logsource:
  category: process_creation
  product: linux

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/cat'
      - '/less'
      - '/more'
      - '/head'
      - '/tail'
      - '/cp'
      - '/python3'
      - '/python'
      - '/perl'
      - '/tdbdump'
      - '/strings'
      - '/hexdump'
      - '/xxd'
  selection_path:
    type: EXECVE
    a1|contains: '/var/lib/sss/db'
  filter_sssd_tooling:
    type: EXECVE
    a0|endswith:
      - '/sssctl'
      - '/sss_cache'
      - '/sssd'
      - '/sssd_be'
      - '/sssd_nss'
      - '/sssd_pam'
  condition: selection_tool and selection_path and not filter_sssd_tooling

falsepositives:
  - T1003.005 (Cached Domain Credentials) is a Windows-native technique; on Linux the closest analog is SSSD cache access. SSSD''s own maintenance tooling is now excluded, but generic interpreters (python3, perl) used for unrelated scripting that happens to reference the cache path string can still match, and direct file reads via raw syscalls that avoid a monitored binary still bypass this entirely.

level: medium

Related sub-techniques

Explore