Cachedump

S0119

Tool.View on attack.mitre.org

About this tool

Cachedump is a publicly-available tool that program extracts cached password hashes from a system’s registry.

Techniques used1

Procedure examples1

TechniqueProcedure example
T1003.005
Cached Domain Credentials

Cachedump can extract cached password hashes from cache entry information.

Groups that use it1

Campaigns0

None recorded.

References1

  1. Mandiant APT1 Open source
    Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.