tool
Cachedump is a publicly-available tool that program extracts cached password hashes from a system’s registry. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
13th percentile · 87% of 825 ATT&CK software entries have more detection rules per technique.
9 distinct rules cover the 1 technique recorded for this tool. 8 Sigma · 1 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Files with well-known filenames (parts of credential dump software or files produced by them) creati (...) | Generic | test | file_event | windows | Sysmon | - | high | Teymur Kheirkhabarov, oscd.community | 2019-11-01 | 2025-10-25 | 8fbf3271-1ef6-4e94-8210-03c2317947f6 | ||||
Detects well-known credential dumping tools execution via service execution events | Generic | test | service | windows | WinEventLog Security | - | high | Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2017-03-05 | 2022-11-29 | f0d1feba-4344-4ca9-8121-a6c97bd6df52 | ||||
Detects well-known credential dumping tools execution via service execution events | Generic | test | service | windows | WinEventLog System | - | high | Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2017-03-05 | 2022-11-29 | 4976aa50-8f41-45c6-8b15-ab3fc10e79ed | ||||
Detects the usage of "reg.exe" in order to dump sensitive registry hives. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113 | 2019-10-22 | 2023-12-13 | fd877b94-9bb5-4191-bb25-d79cbd93c167 | ||||
Detects well-known credential dumping tools execution via specific named pipe creation | Generic | test | pipe_created | windows | Sysmon | - | critical | Teymur Kheirkhabarov, oscd.community | 2019-11-01 | 2023-08-07 | 961d0ba2-3eea-4303-a930-2cf78bbfcc5e | ||||
Detection well-known mimikatz command line arguments | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton | 2019-10-22 | 2023-02-21 | a642964e-bead-4bed-8910-1bb4d63e3b4d | ||||
Detects usage of "cmdkey.exe" to add generic credentials. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113, Nasreddine Bencherchali (Nextron Systems) | 2023-02-03 | 2024-03-05 | b1ec66c6-f4d1-4b5c-96dd-af28ccae7727 | ||||
Detects usage of cmdkey to look for cached credentials on the system | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2019-01-16 | 2024-03-05 | 07f8bdc2-c9b3-472a-9817-5a670b872f53 | ||||
Splunk | The following analytic identifies a process command line querying the CachedLogonsCount registry value in the Winlogon registry. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2022-12-06 | 2026-05-13 | 40ccb8e0-1785-466e-901e-6a8b75c04ecd |
5th percentile · 95% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
99th percentile · 99% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 1 Enterprise technique.
Technique Campaign use over its cumulative rule count.