Kerberos Ccache File Copied via SMB
This rule detects when a Kerberos credential cache (ccache) file is copied over SMB. Attackers may attempt to steal Kerberos ccache files to obtain Kerberos tickets, which can then be used for various credential access attacks like 'Pass the Ticket'. The rule specifically looks for the string '.ccache' within SMB traffic on port 445, indicating the transfer of such a file.
Suricata
