| ID | Name |
|---|---|
| T1003.001 | LSASS Memory |
| T1003.002 | Security Account Manager |
| T1003.003 | NTDS |
| T1003.004 | LSA Secrets |
| T1003.005 | Cached Domain Credentials |
| T1003.006 | DCSync |
| T1003.007 | Proc Filesystem |
| T1003.008 | /etc/passwd and /etc/shadow |
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.[1]
On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.[2] The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style attacks, and instead requires Password Cracking to recover the plaintext password.[3]
With SYSTEM access, the tools/utilities such as Mimikatz, Reg, and secretsdump.py can be used to extract the cached credentials.
Note: Cached credentials for Windows Vista are derived using PBKDF2.[2]
| ID | Name | Description |
|---|---|---|
| G0064 | APT33 |
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[4][5] |
| S0119 | Cachedump |
Cachedump can extract cached password hashes from cache entry information.[6] |
| S0349 | LaZagne |
LaZagne can perform credential dumping from MSCache to obtain account and password information.[7] |
| G0077 | Leafminer |
Leafminer used several tools for retrieving login and password information, including LaZagne.[8] |
| G0069 | MuddyWater |
MuddyWater has performed credential dumping with LaZagne.[9][10] |
| G0049 | OilRig |
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.[11][12][13][14] |
| S0439 | Okrum |
Okrum was seen using modified Quarks PwDump to perform credential dumping.[15] |
| S0192 | Pupy |
| ID | Mitigation | Description |
|---|---|---|
| M1015 | Active Directory Configuration |
Consider adding users to the "Protected Users" Active Directory security group. This can help limit the caching of users' plaintext credentials.[17] |
| M1028 | Operating System Configuration |
Consider limiting the number of cached credentials (HKLM\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon\cachedlogonscountvalue)[18] |
| M1027 | Password Policies |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| M1026 | Privileged Account Management |
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. |
| M1017 | User Training |
Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts. |
| ID | Data Source | Data Component |
|---|---|---|
| DS0017 | Command | Command Execution |
Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,[19] which may require additional logging features to be configured in the operating system to collect necessary information for analysis.
Detection of compromised Valid Accounts in-use by adversaries may help as well.