T1558.005 — Ccache Files

Tactic: Credential Access · Platforms: Linux, macOS

Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having…

Sub-technique of Steal or Forge Kerberos Tickets (T1558).

Sigma detection rules (2)

T1558.005 Steal or Forge Kerberos Tickets: Ccache Files

title: "T1558.005 Steal or Forge Kerberos Tickets: Ccache Files"
id: e109d561-4558-4cc1-8a04-6664e751a7a6
description: 'Detect Kerberos Ccache File Theft or Abuse (T1558.005). (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Excludes klist, sssd_kcm, sssd, and gssproxy in addition to kinit/sshd, since these are common legitimate Kerberos-aware readers of ccache files on SSSD-managed hosts. Tune using: CcachePathBaseline, AllowedProcesses, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1558/005
author: Shahrukh Khan
date: 2026-04-10
license: MIT
tags:
  - attack.credential-access
  - attack.t1558.005

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    name|contains: '/tmp/krb5cc_'
  filter:
    exe|endswith:
      - '/kinit'
      - '/sshd'
      - '/klist'
      - '/sssd_kcm'
      - '/sssd'
      - '/gssproxy'

  condition: selection and not filter

falsepositives:
  - Any process reading a session's ccache outside the expected kinit/sshd/klist/sssd baseline is unusual, but shared multi-user hosts with SSSD can still produce noisy legitimate reads from other GSSAPI-aware daemons not in this exclusion list -- tune CcachePathBaseline/AllowedProcesses accordingly.

level: high

T1558.005 Steal or Forge Kerberos Tickets: Ccache Files

title: "T1558.005 Steal or Forge Kerberos Tickets: Ccache Files"
id: cba8ee83-7708-445d-ab1a-7b401ec4216f
description: 'Detect Kerberos Ccache File Theft or Abuse (T1558.005). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: KerberosAPIProcessBaseline, SuspiciousBinaryList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1558/005
author: Shahrukh Khan
date: 2026-02-13
license: MIT
tags:
  - attack.credential-access
  - attack.t1558.005

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/klist'
    CommandLine|contains: '-c'
  selection2:
    CommandLine|contains: 'KRB5CCNAME'

  condition: 1 of selection*

falsepositives:
  - Kerberos-enabled applications reading the default credential cache during normal single sign-on operations.

level: high

Related sub-techniques

Explore