Cross-source coverage
T1558.005 / ATT&CK
Steal or Forge Kerberos Tickets: Ccache Files
4 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.
The /etc/krb5.conf configuration file and the KRB5CCNAME environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the /tmp directory with a naming format of krb5cc_%UID% or krb5.ccache. On macOS, ccache entries are stored by default in memory with an API:{uuid} naming scheme. Typically, users interact with ticket storage using kinit, which obtains a Ticket-Granting-Ticket (TGT) for the principal; klist, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.
Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform Pass the Ticket attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform Privilege Escalation. Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further Lateral Movement. On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.
- Tactics
- Credential Access
- Platforms
- Linux · macOS
- Telemetry
-
auditd:SYSCALLmacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0024
Detect Kerberos Ccache File Theft or Abuse (T1558.005)
Linux Analytic 0069
Detects unauthorized access, copying, or modification of Kerberos ccache files (krb5cc_%UID% or krb5.ccache) in /tmp or custom paths defined by KRB5CCNAME. Correlates file access with suspicious processes (e.g., credential dumping tools) and subsequent anomalous Kerberos authentication requests from non-standard processes.
auditd:SYSCALLopen: File access attempt on /tmp/krb5cc_* or /tmp/krb5.ccacheauditd:SYSCALLexecve: Execution of klist, kinit, or tools interacting with ccache outside normal user context
macOS Analytic 0070
Detects abnormal interaction with memory-based Kerberos ccache (API:{uuid}) or file-based overrides. Focus on processes attempting to enumerate or extract Kerberos tickets outside of built-in utilities. Detects use of open-source tools (e.g., Bifrost, modified Mimikatz ports) that interact with the Kerberos framework APIs.
macos:unifiedlogKerberos framework calls to API:{uuid} cache outside normal process lineagemacos:osqueryExecution of non-standard binaries accessing Kerberos APIs
elastic/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Kerberos Cached Credentials Dumping | High | Elastic TOML |
| Potential Kerberos Attack via Bifrost | High | Elastic TOML |
| First Time Python Accessed Sensitive Credential Files | Medium | Elastic TOML |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Potential Access to Kerberos Cached Credentials | Undefined | Elastic TOML |