MITRE ATT&CKsub-technique

T1003.005 Cached Domain Credentials

Published 2020-02-21 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Windows, Linux
Version
1.1
Created
2020-02-21

Description

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable. On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash. The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style attacks, and instead requires Password Cracking to recover the plaintext password. On Linux systems, Active Directory credentials can be accessed through caches maintained by software like System Security Services Daemon (SSSD) or Quest Authentication Services (formerly VAS). Cached credential hashes are typically located at `/var/lib/sss/db/cache.[domain].ldb` for SSSD or `/var/opt/quest/vas/authcache/vas_auth.vdb` for Quest. Adversaries can use utilities, such as `tdbdump`, on these database files to dump the cached hashes and use Password Cracking to obtain the plaintext password. With SYSTEM or sudo access, the tools/utilities such as Mimikatz, Reg, and secretsdump.py for Windows or Linikatz for Linux can be used to extract the cached credentials. Note: Cached credentials for Windows Vista are derived using PBKDF2.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1003 OS Credential Dumping technique

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (5)

  • M1015 Active Directory Configuration mitigation
  • M1017 User Training mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation
  • M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · uses (9)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S0439 Okrum software (malware)
  • S0349 LaZagne software (tool)
  • G0077 Leafminer group
  • G0064 APT33 group
  • G0069 MuddyWater group
  • S0192 Pupy software (tool)
  • G0049 OilRig group
  • S0119 Cachedump software (tool)

Referenced by Compliance · mitigates (17)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References