Techniques › T1556
T1556 Modify Authentication Process
defense impairment · persistence · credential access — IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
12
Sigma rules tagged attack.t1556
2
KEV CVEs mapped here
<p>Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.</p><p>Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2020-8193 | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | exploitation technique | Mapped | 2021-11-03 |
| CVE-2020-12812 | Fortinet FortiOS | exploitation technique primary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0104 Detect Modification of Authentication Processes Across Platforms v1.0
AN0287 WindowsDetects modification of LSASS and authentication DLLs, suspicious registry changes to password filter packages, and abnormal process access to lsass.exe. Correlates registry modifications, DLL loads, and process handle access events.Tunable:
MonitoredRegistryKeysTimeWindowAN0288 LinuxDetects modification of PAM configuration files, unauthorized new PAM modules, and suspicious process execution accessing PAM-related binaries. Correlates file modification events in /etc/pam.d/ with process execution of unauthorized binaries.Tunable:WatchedPathsAN0289 macOSDetects unauthorized additions or changes to /Library/Security/SecurityAgentPlugins and suspicious process activity attempting to hook authentication APIs. Correlates file modifications with abnormal plugin loads in authentication flows.Tunable:PluginPathsAN0290 Identity ProviderDetects suspicious configuration changes in IdP authentication flows such as enabling reversible password encryption, MFA bypass, or policy weakening. Correlates policy modification events with unusual administrative activity.Tunable:PolicyBaselineAN0291 IaaSDetects unauthorized changes to IAM authentication configurations such as disabling MFA, creating backdoor access keys, or altering trust policies. Correlates identity policy updates with unusual login behavior.Tunable:ApprovedAccounts
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1556
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 · logsource: product=azure service=auditlogs · 26e7c5e2-6545-481e-b7e6-050143459635
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · 4bb80281-3756-4ec8-a88e-523c5a6fda9e
Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
Author: AlertIQ
· 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=auditlogs · 4d78a000-ab52-4564-88a5-7ab5242b20c7
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 (modified 2024-05-28) · logsource: product=azure service=auditlogs · 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
Monitor and alert on group membership removal of groups that have CA policy modification access
Author: @ionsor
· 2022-02-08 (modified 2026-04-30) · logsource: product=azure service=auditlogs · 7ea78478-a4f9-42a6-9dcd-f861816122bf
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
Author: Muhammad Faisal (@faisalusuf)
· 2023-01-29 (modified 2024-07-22) · logsource: product=github service=audit · 8622c92d-c00e-463c-b09d-fd06166f6794
Detects when a user disables a critical security feature for an organization.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 91c95675-1f27-46d0-bead-d1ae96b97cd3
Monitor and alert on group membership additions of groups that have CA policy modification access
Author: Nischal Khadgi
· 2024-07-11 · logsource: product=windows category=registry_set · b61e87c0-50db-4b2e-8986-6a2be94b33b0
Detects changes to "DsrmAdminLogonBehavior" registry value.
During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure.
Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory.
If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM.
If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped.
If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · c2496b41-16a9-4016-a776-b23f8910dc58
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
Author: Michael McIntyre @wtfender
· 2023-09-27 · logsource: product=aws service=cloudtrail · d3adb3ef-b7e7-4003-9092-1924c797db35
Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
Author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
· 2022-10-17 · logsource: product=windows service=security · f598ea0c-c25a-4f72-a219-50c44411c791
Detects possible addition of shadow credentials to an active directory object.
Sub-techniques
| ID | Name | Sigma rules | KEV CVEs |
|---|---|---|---|
| T1556.001 | Domain Controller Authentication | 0 | 0 |
| T1556.002 | Password Filter DLL | 3 | 0 |
| T1556.003 | Pluggable Authentication Modules | 0 | 0 |
| T1556.004 | Network Device Authentication | 1 | 0 |
| T1556.005 | Reversible Encryption | 0 | 0 |
| T1556.006 | Multi-Factor Authentication | 3 | 0 |
| T1556.007 | Hybrid Identity | 0 | 0 |
| T1556.008 | Network Provider DLL | 0 | 0 |
| T1556.009 | Conditional Access Policies | 0 | 0 |