Cached Domain Credentials Accessed via Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to access cached domain credentials via the Windows Registry over the SMB protocol (port 445). It specifically looks for the string "SECURITY\Cache" within TCP traffic directed to the HOME_NET on port 445, indicating a potential credential access attempt.