Detect Cached Domain Credentials in Sumo Logic CSE
Adversaries access cached domain credentials (DCC2/MS-Cache v2) stored locally for offline authentication when domain controllers are unavailable. On Windows, these are stored as MSCACHE v2 (PBKDF2-derived) hashes in HKLM\SECURITY\Cache and cannot be used for pass-the-hash but can be cracked offline. Linux systems using SSSD store cached credentials at /var/lib/sss/db/cache.[domain].ldb. Tools include Mimikatz (lsadump::cache), LaZagne, Cachedump, and Quarks PwDump. Used by Okrum, APT33, OilRig, Leafminer, MuddyWater.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1003 OS Credential Dumping
- Sub-technique
- T1003.005 Cached Domain Credentials
- Canonical reference
- https://attack.mitre.org/techniques/T1003/005/
Sumo Detection Query
(_sourceCategory="windows/sysmon" OR _sourceCategory="os/windows/sysmon")
| parse xml field=_raw "*" as xml_data nodrop
| parse field=_raw "<EventID>*</EventID>" as event_id nodrop
| parse field=_raw "<Data Name='Image'>*</Data>" as process_image nodrop
| parse field=_raw "<Data Name='CommandLine'>*</Data>" as command_line nodrop
| parse field=_raw "<Data Name='TargetObject'>*</Data>" as target_object nodrop
| parse field=_raw "<Data Name='TargetFilename'>*</Data>" as target_filename nodrop
| parse field=_raw "<Data Name='User'>*</Data>" as user nodrop
| parse field=_raw "<Data Name='Computer'>*</Data>" as computer nodrop
| where (
(
event_id = "1"
and (
matches(toLowerCase(command_line), ".*lsadump::cache.*")
or matches(toLowerCase(command_line), ".*cachedump.*")
or matches(toLowerCase(command_line), ".*mscache.*")
or matches(toLowerCase(command_line), ".*ms-cache.*")
or matches(toLowerCase(process_image), ".*(lazagne|cachedump|fgdump|gsecdump)\.exe")
)
)
or (
event_id in ("12", "13", "14")
and (
matches(target_object, ".*\\\\SECURITY\\\\Cache.*")
or matches(target_object, ".*\\\\SECURITY\\\\Policy\\\\Secrets\\\\NL\$.*")
)
and !matches(toLowerCase(process_image), ".*(lsass|svchost|services)\.exe")
)
or (
event_id = "11"
and (
matches(target_filename, "/var/lib/sss/db/.*")
or matches(target_filename, "/var/opt/quest/vas/authcache/.*")
)
and !matches(toLowerCase(process_image), ".*sssd.*")
)
)
| eval detection_type = if(event_id = "1", "Process-CredDumpTool",
if(event_id in ("12","13","14"), "Registry-LSACache", "File-SSSDCache"))
| fields _messageTime, computer, user, process_image, command_line, target_object, target_filename, detection_type, event_id
| sort by _messageTime descSumo Logic query detecting T1003.005 cached credential access via Sysmon event parsing. Identifies process creation of known credential dumping tools, unauthorized registry access to SECURITY\Cache and NL$ policy secrets, and file-level access to Linux SSSD credential databases. Classifies findings by detection type for triage prioritization.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise endpoint management platforms (Microsoft SCCM, Tanium) performing registry enumeration during inventory scans — add known management process names to exclusion list
- Windows credential roaming or Credential Manager synchronization processes that legitimately access SECURITY hive subkeys
- Security compliance scanning tools (CIS-CAT, SCAP) checking LSA configuration — identify by scan schedule and source IP correlation
Other platforms for T1003.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Mimikatz Cached Domain Credentials Dump
Expected signal: Sysmon Event ID 1: Process Create for mimikatz.exe with 'lsadump::cache' in CommandLine. Sysmon Event ID 12/13: Registry access to HKLM\SECURITY\Cache by mimikatz.exe. Security Event ID 4688 for mimikatz.exe.
- Test 2Check Cached Credential Count via Registry
Expected signal: Sysmon Event ID 12: Registry Key Opened for HKLM\SECURITY\Cache (if Sysmon is configured to log registry reads). Security Event ID 4656/4663 if registry auditing is enabled. Process Create for reg.exe.
- Test 3Linux SSSD Cache Access Simulation
Expected signal: Linux auditd events for file access on /var/lib/sss/db/ by non-sssd processes. Syslog entries for file access audit events. Process creation events for ls, file, and stat commands.
References (6)
- https://attack.mitre.org/techniques/T1003/005/
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh994565
- https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-and-cracking-mscash-cached-domain-credentials
- https://passlib.readthedocs.io/en/stable/lib/passlib.hash.msdcc2.html
- https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.005/T1003.005.md
Unlock Pro Content
Get the full detection package for T1003.005 including response playbook, investigation guide, and atomic red team tests.