Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)
Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Conditional access policies can evaluate the context and compliance state of a remote device when alternate authentication material is used, reducing the ability to use authentication material from devices that do not satisfy enterprise security requirements.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Using role-based access control (RBAC) to enforce least privilege and prevent domain users from holding local-administrator rights across multiple systems can help limit an adversary’s ability to use alternate authentication material for lateral movement.
References
|
| CIS-16.11 | Leverage Vetted Modules or Services for Application Security Components | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Using vetted authentication modules or services that support token-binding protections that cryptographically bind a token to a secret can help prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Apply secure design principles to implement token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, to help prevent the token from being used by adversaries
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Static and dynamic security checks can verify secure implementation of token handling and token-binding or proof-of-possession controls, helping identify application designs that would allow stolen authentication material to be reused without the intended cryptographic or device-bound protections.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Use of stolen creds | Use of stolen or default authentication credentials (including credential stuffing) | related-to | T1550 | Use Alternate Authentication Material | |
| action.malware.variety.Pass-the-hash | Pass-the-hash | related-to | T1550 | Use Alternate Authentication Material | |
| action.malware.vector.Network propagation | Network propagation | related-to | T1550 | Use Alternate Authentication Material |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| identity_platform | Identity Platform | technique_scores | T1550 | Use Alternate Authentication Material |
Comments
This control may mitigate application access token theft if the application is configured to retrieve temporary security credentials using an IAM role.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_identity_and_access_management | AWS Identity and Access Management | technique_scores | T1550 | Use Alternate Authentication Material |
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1550.003 | Pass the Ticket | 2 |
| T1550.004 | Web Session Cookie | 3 |
| T1550.002 | Pass the Hash | 7 |
| T1550.001 | Application Access Token | 9 |