Potential Access to Kerberos Cached Credentials

[rule]
description = """
Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries
may attempt to dump credentials to obtain account login information in the form of a ticket. These tickets can be
leveraged for lateral movement.
"""
id = "dc8fa849-efb4-45d1-be1a-9472325ff746"
license = "Elastic License v2"
name = "Potential Access to Kerberos Cached Credentials"
os_list = ["macos"]
reference = [
    "https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py",
    "https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html",
]
version = "1.0.29"

query = '''
process where event.type == "start" and event.action == "exec" and
 process.name == "kcc" and process.command_line like~ "*copy_cred_cache*"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"
[[threat.technique.subtechnique]]
id = "T1558.005"
name = "Ccache Files"
reference = "https://attack.mitre.org/techniques/T1558/005/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"