Kerberos ccache Ticket File Access by Non-Kerberos Process T1558.005
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Microsoft Sentinel (KQL)
