T1550: Use Alternate Authentication Material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

active_directory_attacks: PT-CR-830: Cert_Allowed_Alt_SAN: A certificate has been requested that allows you to set an alternative SubjectAccountName parameter. Using this certificate will allow an attacker to impersonate another user, including the domain administrator
active_directory_attacks: PT-CR-833: DC_Auth_with_Pfx: Request a TGT ticket using a certificate or smart card. Attackers can use the received TGT ticket to obtain the NTLM hash of the account. Using this data may allow an attacker to carry out a Pass-The-Hash or Silver Ticket attack
active_directory_attacks: PT-CR-2100: ADCSync_Attack: DCSync attack to obtain NTLM hashes of Active Directory user accounts using AD CS certificates
active_directory_attacks: PT-CR-2101: Bulk_Certs_Allowed_to_One_User: A bulk of certificates was issued to one user. This may indicate the use of the ADCSync utility that creates a request for each user, stores their PFX file in the certificate directory, and then tries to authenticate with the certificate and retrieve the NT hash for each user.

Subtechniques

Detection

ID	DS0015	Data source and component	Application Log: Application Log Content	Description	Monitor for third-party application logging, messaging, and/or other artifacts that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

ID	DS0028	Data source and component	Logon Session: Logon Session Creation	Description	Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account.

ID	DS0026	Data source and component	Active Directory: Active Directory Credential Request	Description	Monitor requests of new ticket granting ticket or service tickets to a Domain Controller, such as Windows EID 4769 or 4768, that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

ID	DS0002	Data source and component	User Account: User Account Authentication	Description	Monitor for an attempt by a user to gain access to a network or computing resource, often by providing credentials that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

ID	DS0006	Data source and component	Web Credential: Web Credential Usage	Description	Monitor for an attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202) that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

ID	Data source and component	Description
DS0015	Application Log: Application Log Content	Monitor for third-party application logging, messaging, and/or other artifacts that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
DS0028	Logon Session: Logon Session Creation	Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account.
DS0026	Active Directory: Active Directory Credential Request	Monitor requests of new ticket granting ticket or service tickets to a Domain Controller, such as Windows EID 4769 or 4768, that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
DS0002	User Account: User Account Authentication	Monitor for an attempt by a user to gain access to a network or computing resource, often by providing credentials that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
DS0006	Web Credential: Web Credential Usage	Monitor for an attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202) that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Mitigation

ID	M1013	Name	Application Developer Guidance	Description	Consider implementing token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, that cryptographically bind a token to a secret. This may prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.

ID	M1015	Name	Active Directory Configuration	Description	Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.

ID	M1018	Name	User Account Management	Description	Enforce the principle of least-privilege. Do not allow a domain user to be in the local administrator group on multiple systems.

ID	M1026	Name	Privileged Account Management	Description	Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.

ID	M1027	Name	Password Policies	Description	Set and enforce secure password policies for accounts.

ID	M1047	Name	Audit	Description	Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.

ID	Name	Description
M1013	Application Developer Guidance	Consider implementing token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, that cryptographically bind a token to a secret. This may prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.
M1015	Active Directory Configuration	Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.
M1018	User Account Management	Enforce the principle of least-privilege. Do not allow a domain user to be in the local administrator group on multiple systems.
M1026	Privileged Account Management	Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.
M1027	Password Policies	Set and enforce secure password policies for accounts.
M1047	Audit	Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.