Skip to content

T1550 Use Alternate Authentication Material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.12

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.

Item Value
ID T1550
Sub-techniques T1550.001, T1550.002, T1550.003, T1550.004
Tactics TA0005, TA0008
Platforms Containers, Google Workspace, IaaS, Office 365, SaaS, Windows
Version 1.2
Created 30 January 2020
Last Modified 01 April 2022

Procedure Examples

ID Name Description
S0661 FoggyWeb FoggyWeb can allow abuse of a compromised AD FS server’s SAML token.4
C0024 SolarWinds Compromise During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.56

Mitigations

ID Mitigation Description
M1026 Privileged Account Management Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary’s ability to perform Lateral Movement between systems.
M1018 User Account Management Enforce the principle of least-privilege. Do not allow a domain user to be in the local administrator group on multiple systems.

Detection

ID Data Source Data Component
DS0026 Active Directory Active Directory Credential Request
DS0015 Application Log Application Log Content
DS0028 Logon Session Logon Session Creation
DS0002 User Account User Account Authentication
DS0006 Web Credential Web Credential Usage

References

  1. NIST. (n.d.). Authentication. Retrieved January 30, 2020. ↩

  2. NIST. (n.d.). Multi-Factor Authentication (MFA). Retrieved January 30, 2020. ↩

  3. Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016. ↩

  4. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021. ↩

  5. Microsoft 365 Defender Team. (2020, December 28). Using Microsoft 365 Defender to protect against Solorigate. Retrieved January 7, 2021. ↩

  6. Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022. ↩