{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1550","id":"T1550","name":"Use Alternate Authentication Material","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1550","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"ab8ca2bcf9c2bf3d05951536266193503ce8e3bd951b62e028cf6d2972d5a6a1","description":"Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. \n\nAuthentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)\n\nCaching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1550","external_id":"T1550"},{"source_name":"NIST Authentication","description":"NIST. (n.d.). Authentication. Retrieved January 30, 2020.","url":"https://csrc.nist.gov/glossary/term/authentication"},{"source_name":"NIST MFA","description":"NIST. (n.d.). Multi-Factor Authentication (MFA). Retrieved September 25, 2024.","url":"https://csrc.nist.gov/glossary/term/multi_factor_authentication"}],"platforms":["Containers","IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1550.001","id":"T1550.001","name":"Application Access Token","page":"techniques/enterprise/T1550.001/"},{"key":"enterprise/T1550.002","id":"T1550.002","name":"Pass the Hash","page":"techniques/enterprise/T1550.002/"},{"key":"enterprise/T1550.003","id":"T1550.003","name":"Pass the Ticket","page":"techniques/enterprise/T1550.003/"},{"key":"enterprise/T1550.004","id":"T1550.004","name":"Web Session Cookie","page":"techniques/enterprise/T1550.004/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."},{"id":"DC0013","name":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component","category":"Host state and inventory","description":"Account inventory and attributes at a point in time.","collection_focus":"Export an authorized directory/account inventory with stable IDs, roles, enabled state and collection time; compare snapshots without exposing credentials.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["account_id","enabled","roles","inventory_time"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0007","name":"Web Credential Usage","page":"telemetry/DC0007/","kind":"attack_component","category":"Identity and SaaS","description":"Observed use of a web credential during authentication or resource access.","collection_focus":"Join workload/non-interactive sign-in or application access records to non-secret credential identifiers and resource results.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["credential_id","resource","action","result","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0007","collector":"illustrative-lab-collector","observation":{"credential_id":"key-lab-1","resource":"lab-api","action":"authenticate","result":"success","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1550","id":"T1550","name":"Use Alternate Authentication Material","domain":"enterprise","platforms":["Containers","IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1550","technique_page":"techniques/enterprise/T1550/","page":"detections/enterprise/T1550/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"sigma_rules":[{"id":"905d389b-b853-46d0-9d3d-dea0d3a3cd49","title":"AWS STS AssumeRole Misuse","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/905d389b-b853-46d0-9d3d-dea0d3a3cd49.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"b45ab1d2-712f-4f01-a751-df3826969807","title":"AWS STS GetSessionToken Misuse","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/b45ab1d2-712f-4f01-a751-df3826969807.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e","title":"AWS Suspicious SAML Activity","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml","author":"Austin Songer","kind":"sigma"},{"id":"def8b624-e08f-4ae1-8612-1ba21190da6b","title":"Outgoing Logon with New Credentials","status":"test","level":"low","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/def8b624-e08f-4ae1-8612-1ba21190da6b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_susp_logon_newcredentials.yml","author":"Max Altgelt (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0338","name":"Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)","url":"https://attack.mitre.org/detectionstrategies/DET0338","stix_id":"x-mitre-detection-strategy--2b666abc-e642-4f40-abec-36bd48f1f15c","relationship_id":"relationship--a152e0f1-2588-4c93-aeb8-78a596e153e0","description":"","analytics":[{"id":"AN0954","name":"Analytic 0954","guidance":"Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0954","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Allows tuning of how far apart related logon and process events can be correlated"},{"field":"UserContext","description":"Customize for high-value or service accounts with restricted access policies"}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"WinEventLog:Security","channel":"EventCode=4624, 4648","platforms":["Windows"],"analytic_id":"AN0954","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0954","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0954","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0954","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0955","name":"Analytic 0955","guidance":"Access tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0955","platforms":["Linux"],"tuning":[{"field":"SourceIPWhitelist","description":"Tune for approved jump boxes or bastion hosts"},{"field":"AuthMethod","description":"Filter on use of password vs publickey methods for better coverage"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"auditd:SYSCALL","channel":"execution of ssh, scp, or sftp using previously unseen credentials or keys","platforms":["Linux"],"analytic_id":"AN0955","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0955","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"NSM:Connections","channel":"Accepted publickey for user from unusual IP or without tty","platforms":["Linux"],"analytic_id":"AN0955","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0955","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN0956","name":"Analytic 0956","guidance":"Token replay or impersonation in federated logins without interactive browser session or MFA prompts.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0956","platforms":["Identity Provider"],"tuning":[{"field":"MFAContextRequired","description":"Customize for accounts where MFA must always precede token issuance"},{"field":"RefreshTokenReuseThreshold","description":"Threshold for number of times a refresh token is reused without re-auth"}],"log_sources":[{"component_id":"DC0007","component":"Web Credential Usage","name":"azure:signinlogs","channel":"TokenIssuanceStart, TokenIssuanceSuccess","platforms":["Identity Provider"],"analytic_id":"AN0956","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0956","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0007/"},{"component_id":"DC0002","component":"User Account Authentication","name":"m365:unified","channel":"login using refresh_token with no preceding authentication context","platforms":["Identity Provider"],"analytic_id":"AN0956","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0956","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN0957","name":"Analytic 0957","guidance":"Unusual reuse of OAuth access tokens from different geographic regions, without full login events.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0957","platforms":["SaaS"],"tuning":[{"field":"GeoIPDistanceThreshold","description":"Minimum distance between token reuse events to trigger detection"}],"log_sources":[{"component_id":"DC0007","component":"Web Credential Usage","name":"saas:googleworkspace","channel":"access_token issued","platforms":["SaaS"],"analytic_id":"AN0957","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0957","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0007/"},{"component_id":"DC0002","component":"User Account Authentication","name":"saas:googleworkspace","channel":"API access without user login","platforms":["SaaS"],"analytic_id":"AN0957","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0957","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN0958","name":"Analytic 0958","guidance":"Container process uses mounted cloud credentials or token cache to authenticate without known orchestration.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0958","platforms":["Containers"],"tuning":[{"field":"ContainerLabel","description":"Restrict to prod workloads or certain namespaces"},{"field":"CredentialPath","description":"Path used to mount sensitive tokens (e.g., /.aws/credentials)"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"docker:runtime","channel":"execution of cloud CLI tool (e.g., aws, az) inside container","platforms":["Containers"],"analytic_id":"AN0958","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0958","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0013","component":"User Account Metadata","name":"AWS:CloudTrail","channel":"AssumeRole","platforms":["Containers"],"analytic_id":"AN0958","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0958","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]},{"id":"AN0959","name":"Analytic 0959","guidance":"Access token reuse to connect to SharePoint or Outlook APIs without interactive user context.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0959","platforms":["Office Suite"],"tuning":[{"field":"UserAgentCheck","description":"Tune to detect access from CLI agents or scripts rather than interactive browsers"}],"log_sources":[{"component_id":"DC0007","component":"Web Credential Usage","name":"m365:unified","channel":"TokenIssued, FileAccessed","platforms":["Office Suite"],"analytic_id":"AN0959","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0959","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0007/"}]},{"id":"AN0960","name":"Analytic 0960","guidance":"Use of instance metadata tokens across instances or misuse of short-lived tokens issued for different roles.","url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0960","platforms":["IaaS"],"tuning":[{"field":"TokenReuseWindow","description":"Time window where token reuse is suspicious"},{"field":"RoleMismatchAlerting","description":"Enable if tokens for RoleA are used in resources only RoleB should access"}],"log_sources":[{"component_id":"DC0007","component":"Web Credential Usage","name":"AWS:CloudTrail","channel":"GetCallerIdentity","platforms":["IaaS"],"analytic_id":"AN0960","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0960","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0007/"},{"component_id":"DC0013","component":"User Account Metadata","name":"AWS:CloudTrail","channel":"AssumeRole","platforms":["IaaS"],"analytic_id":"AN0960","source_url":"https://attack.mitre.org/detectionstrategies/DET0338#AN0960","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"},{"id":"DC0013","name":"User Account Metadata","tag":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component"},{"id":"DC0007","name":"Web Credential Usage","tag":"Web Credential Usage","page":"telemetry/DC0007/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0661","name":"FoggyWeb","url":"https://attack.mitre.org/software/S0661","kind":"malware","description":"[FoggyWeb](https://attack.mitre.org/software/S0661) can allow abuse of a compromised AD FS server's SAML token.(Citation: MSTIC FoggyWeb September 2021)","relationship_id":"relationship--6ee04a90-7158-43a6-8133-9b498f1fef2c","references":[{"source_name":"MSTIC FoggyWeb September 2021","description":"Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}]}],"actors":[],"mitigations":[{"id":"M1013","name":"Application Developer Guidance","url":"https://attack.mitre.org/mitigations/M1013","kind":"course-of-action","description":"Consider implementing token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, that cryptographically bind a token to a secret. This may prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.(Citation: Microsoft Token Protection 2023)(Citation: Okta DPoP 2023)","relationship_id":"relationship--a53e9789-54e4-486c-8856-3281c9ef1a23","references":[{"source_name":"Microsoft Token Protection 2023","description":"Microsoft. (2023, October 23). Conditional Access: Token protection (preview). Retrieved January 2, 2024.","url":"https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection"},{"source_name":"Okta DPoP 2023","description":"Venkat Viswanathan. (2023, June 13). A leap forward in token security: Okta adds support for DPoP. Retrieved January 2, 2024.","url":"https://www.okta.com/blog/2023/06/a-leap-forward-in-token-security-okta-adds-support-for-dpop/"}]},{"id":"M1015","name":"Active Directory Configuration","url":"https://attack.mitre.org/mitigations/M1015","kind":"course-of-action","description":"Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.","relationship_id":"relationship--868a59bb-27ed-4c54-8de0-54fcc22e911e","references":[]},{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Enforce the principle of least-privilege. Do not allow a domain user to be in the local administrator group on multiple systems.","relationship_id":"relationship--bdf60e66-264d-45ec-bb67-b74fa04fe28e","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.","relationship_id":"relationship--72904b3d-5b24-4698-8094-8919f3bda494","references":[]},{"id":"M1027","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M1027","kind":"course-of-action","description":"Set and enforce secure password policies for accounts.","relationship_id":"relationship--5aecf348-f5d8-4e96-93bb-d9517913167f","references":[]},{"id":"M1036","name":"Account Use Policies","url":"https://attack.mitre.org/mitigations/M1036","kind":"course-of-action","description":"Where possible, consider restricting the use of authentication material outside of expected contexts.","relationship_id":"relationship--71f51186-1805-4108-bde1-5f999de8603d","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.","relationship_id":"relationship--4aa81ed2-b2d8-490f-a0b4-e0d2e5772acc","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1550":"/ttp-simulation/techniques/enterprise/T1550/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1550","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0007","collector":"illustrative-lab-collector","observation":{"credential_id":"key-lab-1","resource":"lab-api","action":"authenticate","result":"success","source_ip":"192.0.2.10"}}]}}