ATT&CK technique
View on MITRE ATT&CK →
T1003.005
Cached Domain Credentials
Credential Access
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | PowerShell Invoke-NinjaCopy script | production | 2026-09-18 |
| elastic | Sensitive Registry Hive Access via RegBack | production | 2026-09-18 |
| elastic | Potential Invoke-Mimikatz PowerShell Script | production | 2026-09-18 |
| splunk | Windows Cached Domain Credentials Reg Query | production | 2026-05-13 |
| sigma | Cred Dump Tools Dropped Files | test | 2025-10-25 |
| sigma | New Generic Credentials Added Via Cmdkey.EXE | test | 2024-03-05 |
| sigma | Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE | test | 2024-03-05 |
| sigma | Dumping of Sensitive Hives Via Reg.EXE | test | 2023-12-13 |
| sigma | HackTool - Credential Dumping Tools Named Pipe Created | test | 2023-08-07 |
| sigma | HackTool - Mimikatz Execution | test | 2023-02-21 |
| sigma | Credential Dumping Tools Service Execution - Security | test | 2022-11-29 |
| sigma | Credential Dumping Tools Service Execution - System | test | 2022-11-29 |