Offline domain credential cache file read on a Linux host

Siemphony@siemphonyhighT1003.005unverifiedPlaybook · Credential theft

Matches a process launched with the path of an offline domain-credential cache on its command line — the SSSD cache database and the Quest authentication cache that AN1418 names, plus the SSSD secrets database, which is added here rather than taken from MITRE. The match sits on CommandLine and not on Image on purpose: AN1418 mentions tdbdump, but the file is equally readable with cat, cp, strings or tar, and on auditd SYSCALL records the `exe=` field holds the interpreter whenever the reader is wrapped in a shell script or invoked through sudo, so keying on the executable would miss most of the ways this actually happens. Two structural limits worth stating: a reader invoked from inside the directory with a bare filename writes no absolute path and is invisible here, and so is anything that opens the file through a path built at runtime — the analytic's other source, an auditd watch such as `-w /var/lib/sss/db/ -p r`, is the complement that catches both. The Windows arm of this technique is not attempted here because the command lines it would match, `reg save HKLM\SECURITY` and its variants, are already covered by the T1003.002 rule in this corpus. auditd does not record execve out of the box; without an explicit `-a always,exit -F arch=b64 -S execve` rule this returns nothing at all, and zero rows means blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0513, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Offline domain credential cache file read on a Linux host2id: d917bd89-3391-47ad-9e23-5028bbd8847a3status: experimental4description: |5  Matches a process launched with the path of an offline domain-credential6  cache on its command line — the SSSD cache database and the Quest7  authentication cache that AN1418 names, plus the SSSD secrets database, which8  is added here rather than taken from MITRE. The match sits on CommandLine and9  not on Image on purpose: AN1418 mentions tdbdump, but the file is equally10  readable with cat, cp, strings or tar, and on auditd SYSCALL records the11  `exe=` field holds the interpreter whenever the reader is wrapped in a shell12  script or invoked through sudo, so keying on the executable would miss most13  of the ways this actually happens. Two structural limits worth stating: a14  reader invoked from inside the directory with a bare filename writes no15  absolute path and is invisible here, and so is anything that opens the file16  through a path built at runtime — the analytic's other source, an auditd17  watch such as `-w /var/lib/sss/db/ -p r`, is the complement that catches18  both. The Windows arm of this technique is not attempted here because the19  command lines it would match, `reg save HKLM\SECURITY` and its variants, are20  already covered by the T1003.002 rule in this corpus. auditd does not record21  execve out of the box; without an explicit `-a always,exit -F arch=b64 -S22  execve` rule this returns nothing at all, and zero rows means blind rather23  than quiet.24  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0513, not hand-written and not tested by its author. Any lab result is on this rule's own page.25references:26  - https://attack.mitre.org/techniques/T1003/00527  - https://attack.mitre.org/detectionstrategies/DET051328author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)29date: 2026-08-1630tags:31  - attack.credential-access32  - attack.t1003.00533logsource:34  category: process_creation35  product: linux36detection:37  selection:38    CommandLine|contains:39      - '/var/lib/sss/db/cache'40      - '/var/lib/sss/secrets'41      - '/var/opt/quest/vas/authcache'42  condition: selection43falsepositives:44  - "The documented SSSD cache-clearing procedure, where an administrator, a configuration-management run or a package upgrade script removes the cache database by absolute path before restarting the daemon. This is routine on any estate with intermittent domain connectivity and is the most likely hit; MITRE's filepath knob is where the approved forms of the command belong."45  - "Support and troubleshooting work on offline authentication failures, where an administrator or a vendor engineer runs tdbdump, ldbsearch, strings or plain cat against the cache to see which principals are held. The command is the same one this rule is written for and only the operator account separates them."46  - "Backup, disaster-recovery and endpoint forensic-collection agents that enumerate the cache file by absolute path on a schedule, producing a predictable recurring hit under a service account at a fixed time."47  - "Monitoring and compliance checks that stat, size or checksum the cache file to detect corruption, which match the path without ever reading its contents."48level: high

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "/var/lib/sss/db/cache" or ProcessCommandLine contains "/var/lib/sss/secrets" or ProcessCommandLine contains "/var/opt/quest/vas/authcache")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*/var/lib/sss/db/cache*" OR CommandLine="*/var/lib/sss/secrets*" OR CommandLine="*/var/opt/quest/vas/authcache*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*/var/lib/sss/db/cache*" OR TO_LOWER(process.command_line) LIKE "*/var/lib/sss/secrets*" OR TO_LOWER(process.command_line) LIKE "*/var/opt/quest/vas/authcache*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(/var/lib/sss/db/cache|/var/lib/sss/secrets|/var/opt/quest/vas/authcache)</field>    <description>Offline domain credential cache file read on a Linux host</description>    <mitre>      <id>T1003.005</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: high
Category: credential_dump
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d917bd89-3391-47ad-9e23-5028bbd8847a

ATT&CKT1003.005

T1003.005Cached Domain Credentials

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1003.005, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Widen the paths to /var/lib/sss/db and /var/opt/quest/vas before narrowing anything else — coverage first. Then use MITRE's filepath knob to record the sanctioned cache-clearing and backup command lines as exclusions, and its CommandLine knob to scope to reader tools if volume forces it. MITRE's TimeWindow knob (elevation followed by file access) has no Sigma expression and belongs in your correlation layer.
level: high sits next to a first false positive the rule itself calls "the most likely hit". That level survives only because cache clearing is rare, not because the command is unambiguous — say so in your deployment notes, or drop to medium until the approved forms are excluded.

Declared by the author

The documented SSSD cache-clearing procedure, where an administrator, a configuration-management run or a package upgrade script removes the cache database by absolute path before restarting the daemon. This is routine on any estate with intermittent domain connectivity and is the most likely hit; MITRE's filepath knob is where the approved forms of the command belong.
Support and troubleshooting work on offline authentication failures, where an administrator or a vendor engineer runs tdbdump, ldbsearch, strings or plain cat against the cache to see which principals are held. The command is the same one this rule is written for and only the operator account separates them.
Backup, disaster-recovery and endpoint forensic-collection agents that enumerate the cache file by absolute path on a schedule, producing a predictable recurring hit under a service account at a fixed time.
Monitoring and compliance checks that stat, size or checksum the cache file to detect corruption, which match the path without ever reading its contents.

Lessoncredential dump

credential dumpAI draft — unreviewed

01 · What this rule detects

A process on a Linux host launched with the path of an offline domain-credential cache somewhere on its command line. MITRE's analytic AN1418 describes "access to SSSD or Quest VAS cached credential databases using tdbdump or other file access patterns, requiring sudo/root access". Neither half survives into Sigma: "requiring sudo/root" is a property of the session, and "access" is a file operation the process-creation feed never sees. What the rule observes is that a command started with the cache path in its arguments — weaker than the title's word "read". rm, stat, ls and a configuration-management manifest all match without a byte being read.

02 · Telemetry you need

auditd emits no execve by default. Without an explicit
auditd has no `CommandLine` field. argv arrives as separate a0…aN keys,
The analytic's other source, a file watch such as -w /var/lib/sss/db/ -p r,

03 · How the logic works

One selection, one field, three literals:

The interesting decision is what the rule refused to key on. AN1418 names tdbdump, and the obvious rule is Image|endswith: '/tdbdump'. That is wrong twice over: the same file is readable with cat, cp, strings or tar, and on an auditd SYSCALL record exe= holds the interpreter whenever the reader is wrapped in a shell script or reached through sudo. Keying on the artefact rather than the tool is the right instinct — the same trap that kills Image|endswith: '/stegosuite' elsewhere in this corpus. The literals are MITRE's filepath knob, populated here from the two paths in the ATT&CK description plus the SSSD secrets database, which the author added. The Windows arm of DET0513 is deliberately skipped: its reg save HKLM\SECURITY command lines already belong to the T1003.002 rule. Now the flaw. The three terms name files; the credentials live in a directory. tar -czf /tmp/o.tgz /var/lib/sss/db takes every domain's cache and matches none of the three strings. No cd, no renaming — just a different noun.

04 · Common false positives

The documented SSSD cache-clearing procedure, run by an administrator or a
Support work on offline authentication failures — tdbdump, ldbsearch or
Support-bundle collectors. sosreport copies the SSSD database by absolute path

05 · Detection maturity

tier_1: , and no higher.** UNVERIFIED — derived from MITRE ATT&CK DET0513 and never executed against a single log line. Nobody has confirmed execve auditing is on, that CommandLine exists in your pipeline, or that this has ever returned a row.
tier_2: begins by proving the field is populated: run any command mentioning /var/lib/sss and confirm it lands with a readable argument string.
tier_3: needs the file-watch leg and the elevation correlation — both outside this YAML.

Related detections1 nearby

Sudoers file or sudo credential cache altered from a command line

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/d917bd89-3391-47ad-9e23-5028bbd8847a

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Offline domain credential cache file read on a Linux host

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it