Use Alternate Authentication Material

T1550

Technique with 4 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.

Detection rules26

Rules on DetectionCode tagged with T1550 or one of its sub-techniques.

Sigma14

Rule	Level	Log source	Technique
HackTool - Rubeus Execution	critical	windows / process_creation	T1550.003
HackTool - KrbRelayUp Execution	high	windows / process_creation	T1550.003
HackTool - Rubeus Execution - ScriptBlock	high	windows / ps_script	T1550.003
Hacktool Ruler	high	windows / NULL	T1550.002
Successful Overpass the Hash Attempt	high	windows / NULL	T1550.002
AWS Console GetSigninToken Potential Abuse	medium	aws / NULL	T1550.001
AWS Suspicious SAML Activity	medium	aws / NULL	T1550 T1550.001
NTLMv1 Logon Between Client and Server	medium	windows / NULL	T1550.002
Pass the Hash Activity 2	medium	windows / NULL	T1550.002
Uncommon Outbound Kerberos Connection	medium	windows / network_connection	T1550.003
AWS STS AssumeRole Misuse	low	aws / NULL	T1550 T1550.001
AWS STS GetSessionToken Misuse	low	aws / NULL	T1550 T1550.001
NTLM Logon	low	windows / NULL	T1550.002
Outgoing Logon with New Credentials	low	windows / NULL	T1550

Splunk12

Rule	Type	Risk	Data source	Technique
AWS Bedrock Invoke Model Access Denied	TTP	NULL	AWS CloudTrail	T1550
aws detect sts get session token abuse	Hunting	NULL		T1550
Detect Activity Related to Pass the Hash Attacks	Hunting	NULL	Windows Event Log Security 4624	T1550.002
Kerberos TGT Request Using RC4 Encryption	TTP	NULL	Windows Event Log Security 4768	T1550
Mimikatz PassTheTicket CommandLine Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1550.003
Okta Multiple Failed Requests to Access Applications	Hunting	NULL	Okta	T1550.004
Rubeus Command Line Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1550.003
Rubeus Kerberos Ticket Exports Through Winlogon Access	TTP	NULL	Sysmon EventID 10	T1550.003
Unknown Process Using The Kerberos Protocol	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 3	T1550
Windows AD Suspicious Attribute Modification	TTP	NULL	Windows Event Log Security 5136	T1550
Windows Process With NetExec Command Line Parameters	TTP	NULL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1550.003
Windows Steal Authentication Certificates - ESC1 Authentication	TTP	NULL	Windows Event Log Security 4887, Windows Event Log Security 4768	T1550

Sub-techniques4

ID	Name	Examples
T1550.001	Application Access Token	11
T1550.002	Pass the Hash	22
T1550.003	Pass the Ticket	6
T1550.004	Web Session Cookie	2

Groups0

None recorded.

Software1

FoggyWeb

Campaigns1

SolarWinds Compromise

Procedure examples2

Software1

Used by	Procedure example
MalwareFoggyWeb	FoggyWeb can allow abuse of a compromised AD FS server's SAML token. MSTIC FoggyWeb September 2021

Campaigns1

Used by	Procedure example
CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services. Microsoft 365 Defender Solorigate Secureworks IRON RITUAL Profile

References2

NIST Authentication Open source
NIST. (n.d.). Authentication. Retrieved January 30, 2020.
NIST MFA Open source
NIST. (n.d.). Multi-Factor Authentication (MFA). Retrieved September 25, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.