Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1558.005_ccache-files
Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache).
Passed 17 of 22 test cases with the skill, and 10 of 22 without it.
and 5 more in the full report
7 fixed10 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
When evaluating automated testing options for T1558.005, what is the current availability status of Atomic Red Team tests for Kerberos Ccache Files?
| Checked | Without skill | With skill |
|---|---|---|
| States that no Atomic Red Team tests exist for T1558.005. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1558
Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.
The /etc/krb5.conf configuration file and the KRB5CCNAME environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the /tmp directory with a naming format of krb5cc_%UID% or krb5.ccache. On macOS, ccache entries are stored by default in memory with an API:{uuid} naming scheme. Typically, users interact with ticket storage using kinit, which obtains a Ticket-Granting-Ticket (TGT) for the principal; klist, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.
Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform Pass the Ticket attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform Privilege Escalation. Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further Lateral Movement. On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.
Platforms: Linux, macOS
Identify Attack Surface: Determine if the target environment is susceptible to Ccache Files by examining the target platforms (Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1558.005 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 10 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.