{"id":"T1550","name":"Use Alternate Authentication Material","url":"https://attack.mitre.org/techniques/T1550","tactics":["lateral-movement"],"platforms":["Containers","IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0338","stix_id":"x-mitre-detection-strategy--2b666abc-e642-4f40-abec-36bd48f1f15c","name":"Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)","url":"https://attack.mitre.org/detectionstrategies/DET0338","analytics":[{"id":"AN0954","stix_id":"x-mitre-analytic--e7ce6bda-a4d3-43a4-afa0-34d57c34ef0d","name":"Analytic 0954","description":"Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0954","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Allows tuning of how far apart related logon and process events can be correlated"},{"field":"UserContext","description":"Customize for high-value or service accounts with restricted access policies"}],"live":true,"detection_strategies":["DET0338"],"techniques":["T1550"]},{"id":"AN0955","stix_id":"x-mitre-analytic--fbe17895-73cc-432e-8576-f6cab851feb1","name":"Analytic 0955","description":"Access tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0955","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execution of ssh, scp, or sftp using previously unseen credentials or keys","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"auditd-syscall"},{"name":"NSM:Connections","channel":"Accepted publickey for user from unusual IP or without tty","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"nsm-connections"}],"mutable_elements":[{"field":"SourceIPWhitelist","description":"Tune for approved jump boxes or bastion hosts"},{"field":"AuthMethod","description":"Filter on use of password vs publickey methods for better coverage"}],"live":true,"detection_strategies":["DET0338"],"techniques":["T1550"]},{"id":"AN0956","stix_id":"x-mitre-analytic--367cfbd9-fcfd-4336-863e-b6917ff71cb4","name":"Analytic 0956","description":"Token replay or impersonation in federated logins without interactive browser session or MFA prompts.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0956","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:signinlogs","channel":"TokenIssuanceStart, TokenIssuanceSuccess","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"azure-signinlogs"},{"name":"m365:unified","channel":"login using refresh_token with no preceding authentication context","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"MFAContextRequired","description":"Customize for accounts where MFA must always precede token issuance"},{"field":"RefreshTokenReuseThreshold","description":"Threshold for number of times a refresh token is reused without re-auth"}],"live":true,"detection_strategies":["DET0338"],"techniques":["T1550"]},{"id":"AN0957","stix_id":"x-mitre-analytic--7fb5fe4f-ecd1-45a1-8a0f-dc913587e650","name":"Analytic 0957","description":"Unusual reuse of OAuth access tokens from different geographic regions, without full login events.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0957","platforms":["SaaS"],"log_source_references":[{"name":"saas:googleworkspace","channel":"access_token issued","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"saas-googleworkspace"},{"name":"saas:googleworkspace","channel":"API access without user login","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"saas-googleworkspace"}],"mutable_elements":[{"field":"GeoIPDistanceThreshold","description":"Minimum distance between token reuse events to trigger detection"}],"live":true,"detection_strategies":["DET0338"],"techniques":["T1550"]},{"id":"AN0958","stix_id":"x-mitre-analytic--2127b359-24b0-40e2-a202-67e53d5be3b0","name":"Analytic 0958","description":"Container process uses mounted cloud credentials or token cache to authenticate without known orchestration.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0958","platforms":["Containers"],"log_source_references":[{"name":"docker:runtime","channel":"execution of cloud CLI tool (e.g., aws, az) inside container","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"docker-runtime"},{"name":"AWS:CloudTrail","channel":"AssumeRole","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"ContainerLabel","description":"Restrict to prod workloads or certain namespaces"},{"field":"CredentialPath","description":"Path used to mount sensitive tokens (e.g., /.aws/credentials)"}],"live":true,"detection_strategies":["DET0338"],"techniques":["T1550"]},{"id":"AN0959","stix_id":"x-mitre-analytic--1313533a-06c7-44ea-8d75-9a23d3ea23cc","name":"Analytic 0959","description":"Access token reuse to connect to SharePoint or Outlook APIs without interactive user context.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0959","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"TokenIssued, FileAccessed","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"UserAgentCheck","description":"Tune to detect access from CLI agents or scripts rather than interactive browsers"}],"live":true,"detection_strategies":["DET0338"],"techniques":["T1550"]},{"id":"AN0960","stix_id":"x-mitre-analytic--91681b37-7fc7-418c-b4fd-35bebe1d151e","name":"Analytic 0960","description":"Use of instance metadata tokens across instances or misuse of short-lived tokens issued for different roles.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0960","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"GetCallerIdentity","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"AssumeRole","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"TokenReuseWindow","description":"Time window where token reuse is suspicious"},{"field":"RoleMismatchAlerting","description":"Enable if tokens for RoleA are used in resources only RoleB should access"}],"live":true,"detection_strategies":["DET0338"],"techniques":["T1550"]}],"live":true,"version":"1.0","techniques":["T1550"]}],"sigma_rules":[{"id":"905d389b-b853-46d0-9d3d-dea0d3a3cd49","title":"AWS STS AssumeRole Misuse","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-07-24","modified":"2022-10-09","description":"Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.","references":["https://github.com/elastic/detection-rules/pull/1214","https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.lateral-movement","attack.privilege-escalation","attack.t1548","attack.t1550","attack.t1550.001"],"path":"rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml","techniques":["T1548","T1550","T1550.001"],"cves":[]},{"id":"94309181-d345-4cbf-b5fe-061769bdf9cb","title":"User with Privileges Logon","author":"frack113","status":"test","level":"low","date":"2022-10-14","modified":"2023-12-14","description":"Detects logon with \"Special groups\" and \"Special Privileges\" can be thought of as Administrator groups or privileges.","references":["https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.credential-access","attack.t1558","attack.t1649","attack.t1550"],"path":"rules-placeholder/windows/builtin/security/win_security_admin_logon.yml","techniques":["T1558","T1649","T1550"],"cves":[]},{"id":"b45ab1d2-712f-4f01-a751-df3826969807","title":"AWS STS GetSessionToken Misuse","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-07-24","modified":"2022-10-09","description":"Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.","references":["https://github.com/elastic/detection-rules/pull/1213","https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.lateral-movement","attack.privilege-escalation","attack.t1548","attack.t1550","attack.t1550.001"],"path":"rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml","techniques":["T1548","T1550","T1550.001"],"cves":[]},{"id":"def8b624-e08f-4ae1-8612-1ba21190da6b","title":"Outgoing Logon with New Credentials","author":"Max Altgelt (Nextron Systems)","status":"test","level":"low","date":"2022-04-06","modified":null,"description":"Detects logon events that specify new credentials","references":["https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1550"],"path":"rules/windows/builtin/security/account_management/win_security_susp_logon_newcredentials.yml","techniques":["T1550"],"cves":[]},{"id":"f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e","title":"AWS Suspicious SAML Activity","author":"Austin Songer","status":"test","level":"medium","date":"2021-09-22","modified":"2022-12-18","description":"Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.","references":["https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html","https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.initial-access","attack.lateral-movement","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1078","attack.t1548","attack.t1550","attack.t1550.001"],"path":"rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml","techniques":["T1078","T1548","T1550","T1550.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}