AN1417
Analytic 1417
Windows
Detects adversary behavior accessing Windows cached domain credential files using tools like Mimikatz, reg.exe, or PowerShell, often combined with registry exports or LSASS memory scraping.
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=10
[TargetFilename]
Location of cached credential files may vary with OS version or custom registry hive exports.
[CommandLine]
Patterns for reg save, secretsdump, or PowerShell dumping tools may be tuned to org-specific tooling.
[TimeWindow]
Temporal correlation window between process execution and registry/file access.
AN1418
Analytic 1418
Linux
Detects access to SSSD or Quest VAS cached credential databases using tdbdump or other file access patterns, requiring sudo/root access.
auditd:SYSCALL
file
auditd:EXECVE
EXECVE
linux:osquery
process_events
[filepath]
SSSD and Quest cache paths differ by deployment and OS variant.
[CommandLine]
Tunable to capture specific tools (e.g., tdbdump, cat) or scripts accessing cache files.
[TimeWindow]
Time between elevation and file access can be adjusted to account for legitimate system behavior.