Skip to content
attack.paths
Sign in
← LibraryTechnique entry
AD-LSA-CACHECredential Access

Domain Cached Credentials (DCC2)

Extract MSCash2 hashes from SECURITY hive — domain creds cached for offline logon, crackable but slow.

§ Where this technique fits

AD-LSA-CACHE is catalogued under the Credential Access tactic of the offensive-security kill-chain. It appears in 0 approved dossiers in the registry, typically.