Potential Access to Kerberos Cached Credentials


Description

Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credentials to obtain account login information in the form of a ticket. These tickets can be leveraged for lateral movement.

Query · eql

process where event.type == "start" and event.action == "exec" and
 process.name == "kcc" and process.command_line like~ "*copy_cred_cache*"
Raw source Potential Access to Kerberos Cached Credentials · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries
may attempt to dump credentials to obtain account login information in the form of a ticket. These tickets can be
leveraged for lateral movement.
"""
id = "dc8fa849-efb4-45d1-be1a-9472325ff746"
license = "Elastic License v2"
name = "Potential Access to Kerberos Cached Credentials"
os_list = ["macos"]
reference = [
    "https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py",
    "https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html",
]
version = "1.0.29"

query = '''
process where event.type == "start" and event.action == "exec" and
 process.name == "kcc" and process.command_line like~ "*copy_cred_cache*"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"
[[threat.technique.subtechnique]]
id = "T1558.005"
name = "Ccache Files"
reference = "https://attack.mitre.org/techniques/T1558/005/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.