Techniques › T1550
T1550 Use Alternate Authentication Material
lateral movement — Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
7
analytics
5
Sigma rules tagged attack.t1550
0
KEV CVEs mapped here
<p>Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.</p><p>Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.</p><p>Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0338 Behavioral Detection Strategy for Use Alternate Authentication Material (T1550) v1.0
AN0954 WindowsUse of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.Tunable:
TimeWindowUserContextAN0955 LinuxAccess tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.auditd:SYSCALLexecution of ssh, scp, or sftp using previously unseen credentials or keys→ DC0002 User Account AuthenticationNSM:ConnectionsAccepted publickey for user from unusual IP or without tty→ DC0067 Logon Session CreationTunable:SourceIPWhitelistAuthMethodAN0956 Identity ProviderToken replay or impersonation in federated logins without interactive browser session or MFA prompts.m365:unifiedlogin using refresh_token with no preceding authentication context→ DC0002 User Account AuthenticationTunable:MFAContextRequiredRefreshTokenReuseThresholdAN0957 SaaSUnusual reuse of OAuth access tokens from different geographic regions, without full login events.Tunable:GeoIPDistanceThresholdAN0958 ContainersContainer process uses mounted cloud credentials or token cache to authenticate without known orchestration.docker:runtimeexecution of cloud CLI tool (e.g., aws, az) inside container→ DC0038 Application Log ContentTunable:ContainerLabelCredentialPathAN0959 Office SuiteAccess token reuse to connect to SharePoint or Outlook APIs without interactive user context.Tunable:UserAgentCheckAN0960 IaaSUse of instance metadata tokens across instances or misuse of short-lived tokens issued for different roles.Tunable:TokenReuseWindowRoleMismatchAlerting
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1550
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 905d389b-b853-46d0-9d3d-dea0d3a3cd49
Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.
Author: frack113
· 2022-10-14 (modified 2023-12-14) · logsource: product=windows service=security · 94309181-d345-4cbf-b5fe-061769bdf9cb
Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · b45ab1d2-712f-4f01-a751-df3826969807
Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.
Author: Max Altgelt (Nextron Systems)
· 2022-04-06 · logsource: product=windows service=security · def8b624-e08f-4ae1-8612-1ba21190da6b
Detects logon events that specify new credentials
Author: Austin Songer
· 2021-09-22 (modified 2022-12-18) · logsource: product=aws service=cloudtrail · f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.