Authentication Cache Invalidation
Definition
Removing tokens or credentials from an authentication cache to prevent further user associated account accesses.
How it works
Applications can locally cache user authentication credentials for certain server connections. An application may attempt to use the cached credential for a connection. If the cached credentials exist then the user will not be typically prompted for new credentials.
Considerations
Are these cached credentials only on the local host? Can they be persisted to the remote server?
Examples
Windows Credential Management API
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Related ATT&CK Techniques:
These offensive techniques are determined related because of the way this defensive technique,, .
References
The following references were used to develop the Authentication Cache Invalidation knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)