Kerberos ccache file named on a copy or transfer command line

Siemphony@siemphonymediumT1558.005unverified

AN0069's copy-and-carry leg: a process creation whose command line names a Kerberos credential cache — the `krb5cc_%UID%` files Linux writes into /tmp and the `krb5.ccache` form — while the executed binary is one of the copy, archive, encode or transfer utilities an operator reaches for when taking a ticket off the host. Both halves are required. The path alone is not a signal: every kerberised client on the box opens its own cache constantly, so `krb5cc_` on its own would match sssd, ssh, curl and kinit all day; the tool list alone is meaningless. MITRE's `AllowedProcesses` knob ("processes legitimately interacting with ccache, e.g. klist, kinit") is therefore implemented by omission — the kerberos utilities are simply not in the selector — and the tool list itself is authored here, not MITRE's. Vocabulary matters for this one. The brief maps auditd execve onto the `process_creation` / `linux` category, whose field names are the Sysmon for Linux and auditbeat vocabulary (`Image`, `CommandLine`); a raw auditd feed splits the same event into a SYSCALL record carrying `exe` and an EXECVE record carrying `a0`, `a1`, `a2`… and needs a field mapping before this rule can match anything on it. The analytic's other leg — an auditd open() on /tmp/krb5cc_* — is not attempted, because auditd emits PATH and SYSCALL as separate records, so the reading process cannot be gated inside one selection, and an ungated watch on the cache path matches every kerberised daemon on the host. The macOS arm AN0070 is not attempted either: its unifiedlog and osquery sources have no standardised Sigma field names, and the macOS default cache is `API:{uuid}` held in memory, so there is no file path to name. Limits and prerequisite. Check the ccache backend before trusting this rule: a file-based cache is only the *libkrb5 compiled default*, and the RHEL/CentOS/Fedora family and any host running sssd-kcm ship a `default_ccache_name` of `KEYRING:persistent:%{uid}` or `KCM:` in /etc/krb5.conf, which keeps the ticket in the kernel keyring or the KCM daemon and writes no /tmp file at all. On those hosts nothing matches this rule no matter what the adversary does, and zero rows reads as quiet when it means blind — the theft there is `kcmtool`/keyctl or a KCM socket call, which is a different rule. Debian and Ubuntu leave the FILE default in place, which is where this rule works. A cache relocated through `KRB5CCNAME` to a path that contains neither `krb5cc_` nor `krb5.ccache` is invisible for the same reason — that is MITRE's `CcachePathBaseline` knob, and a site that relocates its caches must add its own path here. Anything that reads the file through libkrb5 or its own code rather than a shell utility writes no matching command line at all. Linux process creation is not collected by default: this needs Sysmon for Linux, auditbeat, or an auditd execve rule feeding a pipeline that maps into the fields above, and until one is in place the rule returns zero rows. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0024, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "krb5cc_" or ProcessCommandLine contains "krb5.ccache") and (FolderPath endswith "/cp" or FolderPath endswith "/mv" or FolderPath endswith "/dd" or FolderPath endswith "/cat" or FolderPath endswith "/tar" or FolderPath endswith "/base64" or FolderPath endswith "/xxd" or FolderPath endswith "/od" or FolderPath endswith "/scp" or FolderPath endswith "/rsync" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat" or FolderPath endswith "/gzip" or FolderPath endswith "/zip" or FolderPath endswith "/openssl"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*krb5cc_*" OR CommandLine="*krb5.ccache*") AND (Image="*/cp" OR Image="*/mv" OR Image="*/dd" OR Image="*/cat" OR Image="*/tar" OR Image="*/base64" OR Image="*/xxd" OR Image="*/od" OR Image="*/scp" OR Image="*/rsync" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat" OR Image="*/socat" OR Image="*/gzip" OR Image="*/zip" OR Image="*/openssl"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*krb5cc_*" OR TO_LOWER(process.command_line) LIKE "*krb5.ccache*") AND (TO_LOWER(process.executable) LIKE "*/cp" OR TO_LOWER(process.executable) LIKE "*/mv" OR TO_LOWER(process.executable) LIKE "*/dd" OR TO_LOWER(process.executable) LIKE "*/cat" OR TO_LOWER(process.executable) LIKE "*/tar" OR TO_LOWER(process.executable) LIKE "*/base64" OR TO_LOWER(process.executable) LIKE "*/xxd" OR TO_LOWER(process.executable) LIKE "*/od" OR TO_LOWER(process.executable) LIKE "*/scp" OR TO_LOWER(process.executable) LIKE "*/rsync" OR TO_LOWER(process.executable) LIKE "*/curl" OR TO_LOWER(process.executable) LIKE "*/wget" OR TO_LOWER(process.executable) LIKE "*/nc" OR TO_LOWER(process.executable) LIKE "*/ncat" OR TO_LOWER(process.executable) LIKE "*/socat" OR TO_LOWER(process.executable) LIKE "*/gzip" OR TO_LOWER(process.executable) LIKE "*/zip" OR TO_LOWER(process.executable) LIKE "*/openssl"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(krb5cc_|krb5\.ccache)</field>    <field name="Image" type="pcre2">(?i)(/cp$|/mv$|/dd$|/cat$|/tar$|/base64$|/xxd$|/od$|/scp$|/rsync$|/curl$|/wget$|/nc$|/ncat$|/socat$|/gzip$|/zip$|/openssl$)</field>    <description>Kerberos ccache file named on a copy or transfer command line</description>    <mitre>      <id>T1558.005</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: kerberos_ticket_abuse
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: bf698bb4-cb9a-466c-861d-58066c48b5f5

ATT&CKT1558.005

T1558.005Ccache Files

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonkerberos ticket abuse

kerberos ticket abuseAI draft — unreviewed

01 · What this rule detects

AN0069's copy-and-carry leg. The rule fires on a Linux process creation where a Kerberos credential cache is named on the command line and the executed binary is one of the copy, archive, encode or transfer utilities an operator reaches for when taking a ticket off a host. Both halves are mandatory. The path alone is worthless: every kerberised client on the box touches its own cache constantly, so krb5cc_ on its own matches sssd, ssh, curl and kinit all day. The tool list alone is meaningless. Together they describe a ticket leaving.

02 · Telemetry you need

category: process_creation, product: linux, which the brief maps AN0069's execve source onto. Note the vocabulary: those Sigma field names (Image, CommandLine) are the Sysmon-for-Linux and auditbeat vocabulary. A raw auditd feed splits the same event into a SYSCALL record carrying exe and an EXECVE record carrying a0, a1, a2, and needs a field mapping before this rule can match anything on it. Linux process creation is not collected by default at all; until Sysmon for Linux, auditbeat or a mapped auditd pipeline is in place the rule returns zero rows.

03 · How the logic works

The two substrings are the naming conventions MITRE's technique text gives for Linux. The eighteen-binary tool list is authored here, not MITRE's. MITRE's AllowedProcesses knob — "processes legitimately interacting with ccache, e.g. klist, kinit" — is implemented by omission: the Kerberos utilities are simply absent from the selector, so no exclusion is needed. The analytic's other leg, an auditd open() on /tmp/krb5cc_*, is not attempted, because auditd emits PATH and SYSCALL as separate records, so the reading process cannot be gated inside one selection and an ungated path watch matches every kerberised daemon. The limit worth knowing before you deploy: a file cache is only the libkrb5 compiled default. RHEL, CentOS, Fedora and any host running sssd-kcm ship a default_ccache_name of KEYRING:persistent:%{uid} or KCM:, keeping the ticket in the kernel keyring or the KCM daemon with no /tmp file ever written. On those hosts nothing matches, whatever the adversary does. Debian and Ubuntu leave FILE in place; that is where this rule works.

04 · Common false positives

The dominant source is kerberised batch and container work — Hadoop, Spark and several CI runners document staging a service account's cache into a job directory or bind mount so a child job can reuse the ticket. On a kerberised compute cluster that becomes the bulk of all matches. Admins troubleshooting a Kerberos failure cat or copy /tmp/krb5cc_<uid> aside before kdestroy and a fresh kinit. Support-bundle collectors tar up /tmp under root. Backup and migration jobs rsync a home directory and recreate every cache present.

05 · Detection maturity

tier_1: . UNVERIFIED — derived from DET0024 and never executed against logs. level: medium reflects the cluster false positive being the loudest match. Anything that reads the cache through libkrb5 or its own code writes no command line and is invisible here, so this is a floor, not coverage.
tier_2: means confirming the ccache backend and process-creation feed on real hosts.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope away from compute and CI hosts before the volume means anything — that is the single change that decides whether this is usable. Check default_ccache_name on every target host first; if it is not FILE, this rule is not your detection. If your site relocates caches through KRB5CCNAME to a path containing neither substring, add that path — that is exactly MITRE's CcachePathBaseline knob. Triage on user and destination, not on the tool.

Declared by the author

Administrators troubleshooting a Kerberos failure, who cat or copy /tmp/krb5cc_<uid> aside before running kdestroy and re-running kinit. This is ordinary support work and produces exactly the event the rule looks for.
Kerberised batch and container workloads that stage a service account's cache into a job directory or a bind mount so a child job can reuse the ticket. Hadoop, Spark and several CI runners document this pattern, and on a kerberised compute cluster it becomes the dominant match — scope the rule away from those hosts before trusting its volume.
Support-bundle and diagnostic collectors that tar /tmp or a named cache path into an archive for a vendor case, which puts the ccache path on a tar command line under root.
Backup and migration jobs that rsync or copy a user's home or /tmp between hosts during a rebuild, recreating every cache file that happened to be present.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1558.005, evaluated against their process_creation events.

Share this rule

/u/siemphony/bf698bb4-cb9a-466c-861d-58066c48b5f5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Kerberos ccache file named on a copy or transfer command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it