T1558.005sub-technique of T1558 Steal or Forge Kerberos Tickets
Ccache Files
Linux · macOSnothing on this site yetT1558.005 on attack.mitre.org
Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detect Kerberos Ccache File Theft or Abuse (T1558.005)
- Detects unauthorized access, copying, or modification of Kerberos ccache files (krb5cc_%UID% or krb5.ccache) in /tmp or custom paths defined by KRB5CCNAME. Correlates file access with suspicious processes (e.g., credential dumping tools) and subsequent anomalous Kerberos authentication requests from non-standard...
- Detects abnormal interaction with memory-based Kerberos ccache (API:{uuid}) or file-based overrides. Focus on processes attempting to enumerate or extract Kerberos tickets outside of built-in utilities.
what reduces it
- M1047 Audit. Enable and perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. For example, use `auditd` to audit access to hashes, machine tickets, or `/tmp` files. If using sssd and Vintela, ensure kerberos is disabled if not being used.
- M1043 Credential Access Protection. Protect resources with Security Enhanced Linux (SELinux) by defining entry points, process types, and file labels.