Cached Domain Credentials

This entry covers the Windows variant of ATT&CK T1003.005: access to cached domain logon verifier data (DCC2/MS-Cache v2) stored locally in the SECURITY hive. Windows uses cached verifiers to permit local sign-in when a domain controller is unavailable. These verifiers validate credentials only on that computer and cannot be presented to another computer for pass-the-hash; recovering plaintext is a separate offline password-recovery action. ATT&CK also describes Linux SSSD and Quest cache variants; this entry does not cover those procedures.