1200KM / detection
T1003.005 Cached Domain Credentials — Detection Rules
Detection workspace for T1003.005 Cached Domain Credentials: 8 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Credential Dumping Tools Service Execution - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
- Credential Dumping Tools Service Execution - System · test · high · {"product":"windows","service":"system"}
- Cred Dump Tools Dropped Files · test · high · {"category":"file_event","product":"windows"}
- HackTool - Credential Dumping Tools Named Pipe Created · test · critical · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
- New Generic Credentials Added Via Cmdkey.EXE · test · medium · {"category":"process_creation","product":"windows"}
- Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE · test · high · {"category":"process_creation","product":"windows"}
- HackTool - Mimikatz Execution · test · high · {"category":"process_creation","product":"windows"}
- Dumping of Sensitive Hives Via Reg.EXE · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0513 Detection of Cached Domain Credential Dumping via Local Hash Cache Access
AN1417 Analytic 1417
Detects adversary behavior accessing Windows cached domain credential files using tools like Mimikatz, reg.exe, or PowerShell, often combined with registry exports or LSASS memory scraping.
AN1418 Analytic 1418
Detects access to SSSD or Quest VAS cached credential databases using tdbdump or other file access patterns, requiring sudo/root access.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.