tfMITRE ATT&CK sub-technique

Ccache Files T1558.005

sub-technique of T1558 Steal or Forge Kerberos Tickets

Tactic: Credential Access
Platforms: Linux, macOS
Version: 1.0
Created: 17 September 2024
Last modified: 15 April 2025

Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Ccache Files MITRE reference T1558.005

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

ImpacketS0357 ↗

Tools – such as getST.py or ticketer.py – can be used to steal or forge Kerberos tickets using ccache files given a password, hash, aesKey, or TGT.1 2

created 2019-01-31TOOLcarried by 18 groups

All 1 software entries for this technique

Offense vs defense T1558.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Ccache Files detection strategy DET0024

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Kerberos Ccache File Theft or Abuse (T1558.005)

Enterprise

2 platforms

AN0069 · Linux

Detects unauthorized access, copying, or modification of Kerberos ccache files (krb5cc_%UID% or krb5.ccache) in /tmp or custom paths defined by KRB5CCNAME. Correlates file access with suspicious processes (e.g., credential dumping tools) and subsequent anomalous Kerberos authentication requests from non-standard processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve: Execution of klist, kinit, or tools interacting with ccache outside normal user context
File AccessDC0055	auditd:SYSCALL	open: File access attempt on /tmp/krb5cc_* or /tmp/krb5.ccache

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CcachePathBaseline	Expected directories or environment variable (KRB5CCNAME) paths for ccache files in the environment.
AllowedProcesses	Baseline list of processes legitimately interacting with ccache (e.g., klist, kinit).
TimeWindow	Correlation window for linking file access, process execution, and Kerberos requests.

AN0070 · macOS

Detects abnormal interaction with memory-based Kerberos ccache (API:{uuid}) or file-based overrides. Focus on processes attempting to enumerate or extract Kerberos tickets outside of built-in utilities. Detects use of open-source tools (e.g., Bifrost, modified Mimikatz ports) that interact with the Kerberos framework APIs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	Execution of non-standard binaries accessing Kerberos APIs
File AccessDC0055	macos:unifiedlog	Kerberos framework calls to API:{uuid} cache outside normal process lineage

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
KerberosAPIProcessBaseline	Expected processes using the Kerberos framework (e.g., loginwindow, kinit).
SuspiciousBinaryList	List of tools or binaries not normally expected to query Kerberos ccache entries.
TimeWindow	Window to link suspicious process activity with Kerberos authentication anomalies.

AuditM1047

Enable and perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. For example, use auditd to audit access to hashes, machine tickets, or /tmp files. If using sssd and Vintela, ensure kerberos is disabled if not being used.

Credential Access ProtectionM1043

Protect resources with Security Enhanced Linux (SELinux) by defining entry points, process types, and file labels.

Ccache Files detections T1558.005

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs