Techniques › T1556 › T1556.004
T1556.004 Network Device Authentication
defense impairment · persistence · credential access — Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1556.004
0
KEV CVEs mapped here
<p>Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.</p><p>Modify System Image may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0272 Detect Modification of Network Device Authentication via Patched System Images v1.0
AN0758 Network DevicesDetects unauthorized modification of network device authentication by correlating OS image file changes, checksum mismatches, or memory verification failures with anomalous authentication events. Focus is on behaviors where patched images introduce hardcoded passwords or bypass native authentication.network:auth
repeated successful authentications with previously unknown accounts or anomalous password acceptance→ DC0002 User Account AuthenticationTunable:BaselineChecksumsAuthFailureThresholdVerificationInterval
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1556.004
Author: Luc Génaux
· 2026-04-28 · logsource: product=cisco service=aaa · ef0ff092-a24a-4fbc-beea-06c08d53e085
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Rules tagged at the parent level (attack.t1556) 12
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 · logsource: product=azure service=auditlogs · 26e7c5e2-6545-481e-b7e6-050143459635
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · 4bb80281-3756-4ec8-a88e-523c5a6fda9e
Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
Author: AlertIQ
· 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=auditlogs · 4d78a000-ab52-4564-88a5-7ab5242b20c7
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 (modified 2024-05-28) · logsource: product=azure service=auditlogs · 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
Monitor and alert on group membership removal of groups that have CA policy modification access
Author: @ionsor
· 2022-02-08 (modified 2026-04-30) · logsource: product=azure service=auditlogs · 7ea78478-a4f9-42a6-9dcd-f861816122bf
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
Author: Muhammad Faisal (@faisalusuf)
· 2023-01-29 (modified 2024-07-22) · logsource: product=github service=audit · 8622c92d-c00e-463c-b09d-fd06166f6794
Detects when a user disables a critical security feature for an organization.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 91c95675-1f27-46d0-bead-d1ae96b97cd3
Monitor and alert on group membership additions of groups that have CA policy modification access
Author: Nischal Khadgi
· 2024-07-11 · logsource: product=windows category=registry_set · b61e87c0-50db-4b2e-8986-6a2be94b33b0
Detects changes to "DsrmAdminLogonBehavior" registry value.
During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure.
Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory.
If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM.
If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped.
If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · c2496b41-16a9-4016-a776-b23f8910dc58
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
Author: Michael McIntyre @wtfender
· 2023-09-27 · logsource: product=aws service=cloudtrail · d3adb3ef-b7e7-4003-9092-1924c797db35
Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
Author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
· 2022-10-17 · logsource: product=windows service=security · f598ea0c-c25a-4f72-a219-50c44411c791
Detects possible addition of shadow credentials to an active directory object.