LeafminerG0077 ↗
Used several tools for retrieving login and password information, including LaZagne.1
tfMITRE ATT&CK sub-technique
Cached Domain Credentials T1003.005
sub-technique of T1003 OS Credential Dumping
- Tactic
- Credential Access
- Platforms
- Windows, Linux
- Version
- 1.1
- Created
- 21 February 2020
- Last modified
- 24 October 2025
- Contributors
- Ed Williams, Trustwave, SpiderLabs; Tim (Wadhwa-)Brown; Yves Yonan
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.4
Tools & malware62nd pct
Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.9
Detection rules73rd pct
Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.Cached Domain Credentials MITRE reference T1003.005
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
APT33G0064 ↗
Has used a variety of publicly available tools like LaZagne to gather credentials.12
MuddyWaterG0069 ↗
OilRigG0049 ↗
Has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.1234
All 4 groups for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
OkrumS0439 ↗
Was seen using modified Quarks PwDump to perform credential dumping.1
LaZagneS0349 ↗
Can perform credential dumping from MSCache to obtain account and password information.1
PupyS0192 ↗
Can use Lazagne for harvesting credentials.1
CachedumpS0119 ↗
Can extract cached password hashes from cache entry information.1
All 4 software entries for this technique
Offense vs defense T1003.005
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 1
first rule: 2017 Q1Cached Domain Credentials detection strategy DET0513
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Cached Domain Credential Dumping via Local Hash Cache Access
2 platforms
AN1417 · Windows
Detects adversary behavior accessing Windows cached domain credential files using tools like Mimikatz, reg.exe, or PowerShell, often combined with registry exports or LSASS memory scraping.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetFilename | Location of cached credential files may vary with OS version or custom registry hive exports. |
| CommandLine | Patterns for reg save, secretsdump, or PowerShell dumping tools may be tuned to org-specific tooling. |
| TimeWindow | Temporal correlation window between process execution and registry/file access. |
AN1418 · Linux
Detects access to SSSD or Quest VAS cached credential databases using tdbdump or other file access patterns, requiring sudo/root access.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:EXECVE | EXECVE |
| Process AccessDC0035 | linux:osquery | process_events |
| File AccessDC0055 | auditd:SYSCALL | file |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| filepath | SSSD and Quest cache paths differ by deployment and OS variant. |
| CommandLine | Tunable to capture specific tools (e.g., tdbdump, cat) or scripts accessing cache files. |
| TimeWindow | Time between elevation and file access can be adjusted to account for legitimate system behavior. |
Consider adding users to the "Protected Users" Active Directory security group. This can help limit the caching of users' plaintext credentials.
Consider limiting the number of cached credentials (HKLM\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon\cachedlogonscountvalue)
Password PoliciesM1027
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
User TrainingM1017
Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition