Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.
The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the /tmp directory with a naming format of krb5cc_%UID% or krb5.ccache. On macOS, ccache entries are stored by default in memory with an API:{uuid} naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux)
Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform Pass the Ticket attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform Privilege Escalation. Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further Lateral Movement. On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| PR.PS-01.07 | Cryptographic keys and certificates | Mitigates | T1558.005 | Ccache Files |
Comments
This diagnostic statement protects against Steal or Forge Kerberos Tickets: Ccache Files through the use of revocation of keys and key management. Employing key protection strategies for key material used in identity management and authentication processes, limitations to specific accounts along with access control mechanisms provides protection against adversaries trying to steal or forge kerberos tickets.
References
|
| ID.AM-08.03 | Data governance and lifecycle management | Mitigates | T1558.005 | Ccache Files |
Comments
This diagnostic statement prevents adversaries from being able to steal data in transit between networks by accessing Wi-Fi access points and abusing Kerberos by stealing tickets in credential cache files. There may be some similarities to NIST 800-53 SI-12 Information Management and Retention. This may provide mitigation of data access/exfiltration techniques.
References
|
| ID.AM-08.05 | Data destruction procedures | Mitigates | T1558.005 | Ccache Files |
Comments
This diagnostic statement prevents adversaries from being able to steal data in transit between networks by accessing Wi-Fi access points and abusing Kerberos by stealing tickets in credential cache files. There may be some similarities to NIST 800-53 SI-12 Information Management and Retention. This may provide mitigation of data access/exfiltration techniques.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CA-07 | Continuous Monitoring | mitigates | T1558.005 | Ccache Files | |
| IA-05 | Authenticator Management | mitigates | T1558.005 | Ccache Files | |
| SC-04 | Information in Shared System Resources | mitigates | T1558.005 | Ccache Files | |
| SI-12 | Information Management and Retention | mitigates | T1558.005 | Ccache Files | |
| SI-07 | Software, Firmware, and Information Integrity | mitigates | T1558.005 | Ccache Files | |
| IA-02 | Identification and Authentication (Organizational Users) | mitigates | T1558.005 | Ccache Files | |
| SI-04 | System Monitoring | mitigates | T1558.005 | Ccache Files | |
| AC-02 | Account Management | mitigates | T1558.005 | Ccache Files | |
| AC-03 | Access Enforcement | mitigates | T1558.005 | Ccache Files | |
| AC-06 | Least Privilege | mitigates | T1558.005 | Ccache Files |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Use of stolen creds | Use of stolen or default authentication credentials (including credential stuffing) | related-to | T1558.005 | Ccache Files | |
| action.hacking.variety.Use of stolen creds | Use of stolen or default authentication credentials (including credential stuffing) | related-to | T1558.005 | Ccache Files |