Steal or Forge Kerberos Tickets: Ccache Files T1558.005

Tactic: Credential Access

Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.

Authoring guide

Patterns shared across the 3 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (6 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
host.os.type3eq 3
event.type2in 2process_started, start
process.args2eq 2, in 1-action, -kerberoast, -ticket, copy_cred_cache
process_name2eq 1, starts_with 1kcc, python
EventType1eq 1open
event.category1eq 1file

Top indicator values (18 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typein
process_started
240
event.typein
start
242
EventTypeeq
open
115
event.categoryeq
file
131
process.argseq
-action
1
process.argseq
-kerberoast
1
process.argseq
-ticket
1
process.argseq
askhash
1
process.argseq
asktgs
1
process.argseq
asktgt
1
process.argseq
copy_cred_cache
1
process.argseq
dump
1
process.argseq
ptt
1
process.argseq
s4u
1
process.argsin
keytab
1
process.argsin
tickets
1
process_nameeq
kcc
1
process_namestarts_with
python
131

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Elastic 3 rules