Steal or Forge Kerberos Tickets: Ccache Files `T1558.005`

Tactic: Credential Access

Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
ESF	exec	Process Execution
ESF	open	File Open

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`event.type`	3	`in` 2, `eq` 1	`start`, `process_started`
`host.os.type`	3	`eq` 3
`process_name`	3	`eq` 2, `starts_with` 1	`kcc`, `python`
`EventType`	2	`eq` 2	`exec`, `open`
`process.args`	2	`eq` 2, `in` 1	`-action`, `-kerberoast`, `-ticket`, `copy_cred_cache`
`CommandLine`	1	`contains` 1	`copy_cred_cache`
`event.category`	1	`eq` 1	`file`

Top indicator values (21 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`in`	`process_started` elasticKerberos Cached Credentials Dumping elasticPotential Kerberos Attack via Bifrost	2	39
`event.type`	`in`	`start` elasticKerberos Cached Credentials Dumping elasticPotential Kerberos Attack via Bifrost	2	41
`process_name`	`eq`	`kcc` elasticKerberos Cached Credentials Dumping elasticPotential Access to Kerberos Cached Credentials	2	2
`CommandLine`	`contains`	`copy_cred_cache` elasticPotential Access to Kerberos Cached Credentials	1
`EventType`	`eq`	`exec` elasticPotential Access to Kerberos Cached Credentials	1	579
`EventType`	`eq`	`open` elasticFirst Time Python Accessed Sensitive Credential Files	1	52
`event.category`	`eq`	`file` elasticFirst Time Python Accessed Sensitive Credential Files	1	43
`event.type`	`eq`	`start` elasticPotential Access to Kerberos Cached Credentials	1	1087
`process.args`	`eq`	`-action` elasticPotential Kerberos Attack via Bifrost	1	2
`process.args`	`eq`	`-kerberoast` elasticPotential Kerberos Attack via Bifrost	1	2
`process.args`	`eq`	`-ticket` elasticPotential Kerberos Attack via Bifrost	1	2
`process.args`	`eq`	`askhash` elasticPotential Kerberos Attack via Bifrost	1	2
`process.args`	`eq`	`asktgs` elasticPotential Kerberos Attack via Bifrost	1	2
`process.args`	`eq`	`asktgt` elasticPotential Kerberos Attack via Bifrost	1	2
`process.args`	`eq`	`copy_cred_cache` elasticKerberos Cached Credentials Dumping	1
`process.args`	`eq`	`dump` elasticPotential Kerberos Attack via Bifrost	1	3
`process.args`	`eq`	`ptt` elasticPotential Kerberos Attack via Bifrost	1	2
`process.args`	`eq`	`s4u` elasticPotential Kerberos Attack via Bifrost	1	2
`process.args`	`in`	`keytab` elasticPotential Kerberos Attack via Bifrost	1	2
`process.args`	`in`	`tickets` elasticPotential Kerberos Attack via Bifrost	1	2
`process_name`	`starts_with`	`python` elasticFirst Time Python Accessed Sensitive Credential Files	1	71

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint