Techniques › T1003.005 › AN1417
AN1417 Analytic 1417
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversary behavior accessing Windows cached domain credential files using tools like Mimikatz, reg.exe, or PowerShell, often combined with registry exports or LSASS memory scraping.</p>
- Detects
- T1003.005 Cached Domain Credentials
- Part of
- DET0513 Detection of Cached Domain Credential Dumping via Local Hash Cache Access
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4663, 4670, 4656 | DC0055 File Access |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TargetFilename | Location of cached credential files may vary with OS version or custom registry hive exports. |
CommandLine | Patterns for reg save, secretsdump, or PowerShell dumping tools may be tuned to org-specific tooling. |
TimeWindow | Temporal correlation window between process execution and registry/file access. |