{"id":"T1556.001","name":"Domain Controller Authentication","url":"https://attack.mitre.org/techniques/T1556/001","tactics":["defense-impairment","persistence","credential-access"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0271","stix_id":"x-mitre-detection-strategy--3ac249d7-5e15-47b4-a507-18d94b11de4d","name":"Detect Domain Controller Authentication Process Modification (Skeleton Key)","url":"https://attack.mitre.org/detectionstrategies/DET0271","analytics":[{"id":"AN0757","stix_id":"x-mitre-analytic--40882c73-344f-4138-894e-049b9bb1f460","name":"Analytic 0757","description":"Detects anomalous process access to LSASS on domain controllers, suspicious module loads of authentication DLLs, and registry or file modifications indicative of Skeleton Key–style patching. Correlates LSASS access attempts with subsequent abnormal logon activity patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0271#AN0757","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:System","channel":"Unexpected modification to lsass.exe or cryptdll.dll","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-system"}],"mutable_elements":[{"field":"MonitoredDLLs","description":"Specific authentication DLLs such as cryptdll.dll and samsrv.dll monitored for tampering."},{"field":"TimeWindow","description":"Correlation window between LSASS memory access, module load, and suspicious logons."},{"field":"UserContext","description":"Baseline expected accounts performing domain controller logon operations."}],"live":true,"detection_strategies":["DET0271"],"techniques":["T1556.001"]}],"live":true,"version":"1.0","techniques":["T1556.001"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}