Techniques › T1558 › T1558.005
T1558.005 Ccache Files
credential access — Linux, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
2
analytics
0
Sigma rules tagged attack.t1558.005
0
KEV CVEs mapped here
<p>Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.</p><p>The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the
/tmp directory with a naming format of krb5cc_%UID% or krb5.ccache. On macOS, ccache entries are stored by default in memory with an API:{uuid} naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.</p><p>Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform Pass the Ticket attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform Privilege Escalation. Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further Lateral Movement. On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0024 Detect Kerberos Ccache File Theft or Abuse (T1558.005) v1.0
AN0069 LinuxDetects unauthorized access, copying, or modification of Kerberos ccache files (krb5cc_%UID% or krb5.ccache) in /tmp or custom paths defined by KRB5CCNAME. Correlates file access with suspicious processes (e.g., credential dumping tools) and subsequent anomalous Kerberos authentication requests from non-standard processes.auditd:SYSCALL
execve: Execution of klist, kinit, or tools interacting with ccache outside normal user context→ DC0032 Process CreationTunable:CcachePathBaselineAllowedProcessesTimeWindowAN0070 macOSDetects abnormal interaction with memory-based Kerberos ccache (API:{uuid}) or file-based overrides. Focus on processes attempting to enumerate or extract Kerberos tickets outside of built-in utilities. Detects use of open-source tools (e.g., Bifrost, modified Mimikatz ports) that interact with the Kerberos framework APIs.macos:unifiedlogKerberos framework calls to API:{uuid} cache outside normal process lineage→ DC0055 File AccessTunable:KerberosAPIProcessBaselineSuspiciousBinaryListTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1558.005
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1558) 6
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: frack113
· 2022-10-14 · logsource: product=windows service=security · 5a44727c-3b85-4713-8c44-4401d5499629
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 78cc2dd2-7d20-4d32-93ff-057084c38b93
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Author: frack113
· 2022-10-14 (modified 2023-12-14) · logsource: product=windows service=security · 94309181-d345-4cbf-b5fe-061769bdf9cb
Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.
Author: Florian Roth (Nextron Systems), David ANDRE
· 2021-11-08 (modified 2024-06-27) · logsource: product=windows category=file_event · 9e099d99-44c2-42b6-a6d8-54c3545cab29
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Author: frack113
· 2025-03-05 · logsource: product=windows category=ps_script · cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
Author: Ilyas Ochkov, oscd.community
· 2019-10-24 (modified 2024-03-15) · logsource: product=windows category=network_connection · e54979bd-c5f9-4d6c-967b-a04b19ac4c74
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.