{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1556","id":"T1556","name":"Modify Authentication Process","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1556","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"a06eb622b908a9de36d114ebae0ee2ae242e7ee45dd1d0f7ad61c23bb3d34f71","description":"Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).\n\nAdversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1556","external_id":"T1556"}],"platforms":["IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","network-infrastructure","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1556.001","id":"T1556.001","name":"Domain Controller Authentication","page":"techniques/enterprise/T1556.001/"},{"key":"enterprise/T1556.002","id":"T1556.002","name":"Password Filter DLL","page":"techniques/enterprise/T1556.002/"},{"key":"enterprise/T1556.003","id":"T1556.003","name":"Pluggable Authentication Modules","page":"techniques/enterprise/T1556.003/"},{"key":"enterprise/T1556.004","id":"T1556.004","name":"Network Device Authentication","page":"techniques/enterprise/T1556.004/"},{"key":"enterprise/T1556.005","id":"T1556.005","name":"Reversible Encryption","page":"techniques/enterprise/T1556.005/"},{"key":"enterprise/T1556.006","id":"T1556.006","name":"Multi-Factor Authentication","page":"techniques/enterprise/T1556.006/"},{"key":"enterprise/T1556.007","id":"T1556.007","name":"Hybrid Identity","page":"techniques/enterprise/T1556.007/"},{"key":"enterprise/T1556.008","id":"T1556.008","name":"Network Provider DLL","page":"techniques/enterprise/T1556.008/"},{"key":"enterprise/T1556.009","id":"T1556.009","name":"Conditional Access Policies","page":"techniques/enterprise/T1556.009/"}],"telemetry":[{"id":"DC0069","name":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a managed cloud service configuration.","collection_focus":"Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["service","resource_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0010","name":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an account attribute, policy or enabled state.","collection_focus":"Enable Audit User Account Management and retain the changed attributes and target account; correlate approved administrative requests.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["target_account","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1556","id":"T1556","name":"Modify Authentication Process","domain":"enterprise","platforms":["IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","network-infrastructure","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1556","technique_page":"techniques/enterprise/T1556/","page":"detections/enterprise/T1556/","status":"rule_source_available","counts":{"sigma":12,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"8622c92d-c00e-463c-b09d-fd06166f6794","title":"Github High Risk Configuration Disabled","status":"test","level":"high","logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"data_path":"data/detection-rules/8622c92d-c00e-463c-b09d-fd06166f6794.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_disable_high_risk_configuration.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"d3adb3ef-b7e7-4003-9092-1924c797db35","title":"AWS Identity Center Identity Provider Change","status":"test","level":"high","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/d3adb3ef-b7e7-4003-9092-1924c797db35.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml","author":"Michael McIntyre @wtfender","kind":"sigma"},{"id":"7ea78478-a4f9-42a6-9dcd-f861816122bf","title":"Disabled MFA to Bypass Authentication Mechanisms","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/7ea78478-a4f9-42a6-9dcd-f861816122bf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_mfa_disabled.yml","author":"@ionsor","kind":"sigma"},{"id":"26e7c5e2-6545-481e-b7e6-050143459635","title":"CA Policy Removed by Non Approved Actor","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/26e7c5e2-6545-481e-b7e6-050143459635.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml","author":"Corissa Koopmans, '@corissalea'","kind":"sigma"},{"id":"50a3c7aa-ec29-44a4-92c1-fce229eef6fc","title":"CA Policy Updated by Non Approved Actor","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/50a3c7aa-ec29-44a4-92c1-fce229eef6fc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml","author":"Corissa Koopmans, '@corissalea'","kind":"sigma"},{"id":"c2496b41-16a9-4016-a776-b23f8910dc58","title":"Certificate-Based Authentication Enabled","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/c2496b41-16a9-4016-a776-b23f8910dc58.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml","author":"Harjot Shah Singh, '@cyb3rjy0t'","kind":"sigma"},{"id":"4bb80281-3756-4ec8-a88e-523c5a6fda9e","title":"New Root Certificate Authority Added","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/4bb80281-3756-4ec8-a88e-523c5a6fda9e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml","author":"Harjot Shah Singh, '@cyb3rjy0t'","kind":"sigma"},{"id":"4d78a000-ab52-4564-88a5-7ab5242b20c7","title":"Change to Authentication Method","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/4d78a000-ab52-4564-88a5-7ab5242b20c7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_change_to_authentication_method.yml","author":"AlertIQ","kind":"sigma"},{"id":"91c95675-1f27-46d0-bead-d1ae96b97cd3","title":"User Added To Group With CA Policy Modification Access","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/91c95675-1f27-46d0-bead-d1ae96b97cd3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml","author":"Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'","kind":"sigma"},{"id":"665e2d43-70dc-4ccc-9d27-026c9dd7ed9c","title":"User Removed From Group With CA Policy Modification Access","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/665e2d43-70dc-4ccc-9d27-026c9dd7ed9c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml","author":"Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'","kind":"sigma"},{"id":"f598ea0c-c25a-4f72-a219-50c44411c791","title":"Possible Shadow Credentials Added","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The \"Audit Directory Service Changes\" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)"},"data_path":"data/detection-rules/f598ea0c-c25a-4f72-a219-50c44411c791.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml","author":"Nasreddine Bencherchali (Nextron Systems), Elastic (idea)","kind":"sigma"},{"id":"b61e87c0-50db-4b2e-8986-6a2be94b33b0","title":"Directory Service Restore Mode(DSRM) Registry Value Tampering","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/b61e87c0-50db-4b2e-8986-6a2be94b33b0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml","author":"Nischal Khadgi","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0104","name":"Detect Modification of Authentication Processes Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0104","stix_id":"x-mitre-detection-strategy--d51dd574-9171-4c46-89bc-0e3bb1178dfe","relationship_id":"relationship--d071af46-206b-4ad4-994a-a4ffb350676e","description":"","analytics":[{"id":"AN0287","name":"Analytic 0287","guidance":"Detects modification of LSASS and authentication DLLs, suspicious registry changes to password filter packages, and abnormal process access to lsass.exe. Correlates registry modifications, DLL loads, and process handle access events.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0287","platforms":["Windows"],"tuning":[{"field":"MonitoredRegistryKeys","description":"Specific LSASS and password filter registry paths monitored for modification."},{"field":"TimeWindow","description":"Correlation window between registry change, DLL load, and lsass.exe access."}],"log_sources":[{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Security","channel":"EventCode=4657","platforms":["Windows"],"analytic_id":"AN0287","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0287","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"},{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN0287","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0287","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0287","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0287","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN0288","name":"Analytic 0288","guidance":"Detects modification of PAM configuration files, unauthorized new PAM modules, and suspicious process execution accessing PAM-related binaries. Correlates file modification events in /etc/pam.d/ with process execution of unauthorized binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0288","platforms":["Linux"],"tuning":[{"field":"WatchedPaths","description":"Critical PAM directories and configuration files monitored for modification."}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"open, write","platforms":["Linux"],"analytic_id":"AN0288","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0288","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0288","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0288","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0289","name":"Analytic 0289","guidance":"Detects unauthorized additions or changes to /Library/Security/SecurityAgentPlugins and suspicious process activity attempting to hook authentication APIs. Correlates file modifications with abnormal plugin loads in authentication flows.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0289","platforms":["macOS"],"tuning":[{"field":"PluginPaths","description":"List of approved authentication plugin directories to baseline."}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"macos:unifiedlog","channel":"SecurityAgentPlugins modification","platforms":["macOS"],"analytic_id":"AN0289","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0289","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0035","component":"Process Access","name":"macos:osquery","channel":"process_open","platforms":["macOS"],"analytic_id":"AN0289","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0289","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"}]},{"id":"AN0290","name":"Analytic 0290","guidance":"Detects suspicious configuration changes in IdP authentication flows such as enabling reversible password encryption, MFA bypass, or policy weakening. Correlates policy modification events with unusual administrative activity.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0290","platforms":["Identity Provider"],"tuning":[{"field":"PolicyBaseline","description":"Expected authentication-related policy configurations to compare against."}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"azure:policy","channel":"UpdatePolicy","platforms":["Identity Provider"],"analytic_id":"AN0290","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0290","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"},{"component_id":"DC0010","component":"User Account Modification","name":"m365:unified","channel":"Set-ADUser OR Set-ADAccountControl","platforms":["Identity Provider"],"analytic_id":"AN0290","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0290","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"}]},{"id":"AN0291","name":"Analytic 0291","guidance":"Detects unauthorized changes to IAM authentication configurations such as disabling MFA, creating backdoor access keys, or altering trust policies. Correlates identity policy updates with unusual login behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0291","platforms":["IaaS"],"tuning":[{"field":"ApprovedAccounts","description":"Baseline list of service accounts expected to modify IAM authentication policies."}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"AWS:CloudTrail","channel":"UpdateLoginProfile","platforms":["IaaS"],"analytic_id":"AN0291","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0291","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"},{"component_id":"DC0069","component":"Cloud Service Modification","name":"AWS:CloudTrail","channel":"UpdateAccountPasswordPolicy","platforms":["IaaS"],"analytic_id":"AN0291","source_url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0291","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"}]}]}],"telemetry_references":[{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0010","name":"User Account Modification","tag":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0377","name":"Ebury","url":"https://attack.mitre.org/software/S0377","kind":"malware","description":"[Ebury](https://attack.mitre.org/software/S0377) can intercept private keys using a trojanized <code>ssh-add</code> function.(Citation: ESET Ebury Feb 2014)","relationship_id":"relationship--5b5a618e-3a67-4223-a158-af4ce7e0c7d9","references":[{"source_name":"ESET Ebury Feb 2014","description":"M.Léveillé, M.. (2014, February 21). An In-depth Analysis of Linux/Ebury. Retrieved April 19, 2019.","url":"https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/"}]},{"id":"S0487","name":"Kessel","url":"https://attack.mitre.org/software/S0487","kind":"malware","description":"[Kessel](https://attack.mitre.org/software/S0487) has trojanized the <sode>ssh_login</code> and <code>user-auth_pubkey</code> functions to steal plaintext credentials.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--8544d4c3-e2e5-44c6-b57d-a169143f49eb","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--70f37bdd-dd94-46de-b41b-dd5e04997d3b","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S9013","name":"DRYHOOK","url":"https://attack.mitre.org/software/S9013","kind":"malware","description":"[DRYHOOK](https://attack.mitre.org/software/S9013) has intercepted and logged user credentials by modifying the Perl module in Ivanti Connect Secure VPN edge-devices located within `/home/perl/DSAuth.pm`.(Citation: Google UNC5221 Ivanti January 2025)(Citation: Picus Security UNC5221 Ivanti May 2025)","relationship_id":"relationship--c15efd63-269b-41c5-a664-cea3dff17c5f","references":[{"source_name":"Google UNC5221 Ivanti January 2025","description":"John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"},{"source_name":"Picus Security UNC5221 Ivanti May 2025","description":"Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.","url":"https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"}]}],"actors":[{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications.(Citation: Mandiant FIN13 Aug 2022)  ","relationship_id":"relationship--df6b68c8-17b5-45b9-8ad1-908c89074531","references":[{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has modified the Authentication, Authorization, and Accounting (AAA) configurations forcing devices to use less secure authentication methods and to send information to their infrastructure.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025) ","relationship_id":"relationship--25c3894b-69ee-49ba-8665-17e2dad68538","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Ensure that proper policies are implemented to dictate the the secure enrollment and deactivation of authentication mechanisms, such as MFA, for user accounts.","relationship_id":"relationship--d3851a98-39b3-4105-ba93-c0cd91eb01eb","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Restrict write access to the `/Library/Security/SecurityAgentPlugins` directory.","relationship_id":"relationship--a6aad172-c44b-4d21-9bf3-bb9c2dce2f67","references":[]},{"id":"M1024","name":"Restrict Registry Permissions","url":"https://attack.mitre.org/mitigations/M1024","kind":"course-of-action","description":"Restrict Registry permissions to disallow the modification of sensitive Registry keys such as `HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order`.","relationship_id":"relationship--1fea6d3f-b097-4e4e-b089-5abd6e2659e7","references":[]},{"id":"M1025","name":"Privileged Process Integrity","url":"https://attack.mitre.org/mitigations/M1025","kind":"course-of-action","description":"Enabled features, such as Protected Process Light (PPL), for LSA.(Citation: Microsoft LSA)","relationship_id":"relationship--ef18d02f-bc68-48d8-8076-10e171fde390","references":[{"source_name":"Microsoft LSA","description":"Microsoft. (2013, July 31). Configuring Additional LSA Protection. Retrieved February 13, 2015.","url":"https://technet.microsoft.com/en-us/library/dn408187.aspx"}]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. (Citation: TechNet Credential Theft) (Citation: TechNet Least Privilege) These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. (Citation: Microsoft Securing Privileged Access)\n\nLimit access to the root account and prevent users from modifying protected components through proper privilege separation (ex SELinux, grsecurity, AppArmor, etc.) and limiting Privilege Escalation opportunities.\n\nLimit on-premises accounts with access to the hybrid identity solution in place. For example, limit Azure AD Global Administrator accounts to only those required, and ensure that these are dedicated cloud-only accounts rather than hybrid ones.(Citation: MagicWeb)","relationship_id":"relationship--dafa1584-bdd9-4c46-be07-2d002a529948","references":[{"source_name":"MagicWeb","description":"Microsoft Threat Intelligence Center, Microsoft Detection and Response Team, Microsoft 365 Defender Research Team . (2022, August 24). MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone. Retrieved September 28, 2022.","url":"https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/"},{"source_name":"TechNet Credential Theft","description":"Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016.","url":"https://technet.microsoft.com/en-us/library/dn535501.aspx"},{"source_name":"TechNet Least Privilege","description":"Microsoft. (2016, April 16). Implementing Least-Privilege Administrative Models. Retrieved June 3, 2016.","url":"https://technet.microsoft.com/en-us/library/dn487450.aspx"},{"source_name":"Microsoft Securing Privileged Access","description":"Plett, C., Poggemeyer, L. (12, October 26). Securing Privileged Access Reference Material. Retrieved April 25, 2017.","url":"https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#a-nameesaebmaesae-administrative-forest-design-approach"}]},{"id":"M1027","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M1027","kind":"course-of-action","description":"Ensure that <code>AllowReversiblePasswordEncryption</code> property is set to disabled unless there are application requirements.(Citation: store_pwd_rev_enc)","relationship_id":"relationship--6a1d90c0-f103-4e7f-b462-73749407dceb","references":[{"source_name":"store_pwd_rev_enc","description":"Microsoft. (2021, October 28). Store passwords using reversible encryption. Retrieved January 3, 2022.","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption"}]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (`C:\\Windows\\System32\\` by default) of a domain controller and/or local computer with a corresponding entry in `HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Notification Packages`. \n\nStarting in Windows 11 22H2, the `EnableMPRNotifications` policy can be disabled through Group Policy or through a configuration service provider to prevent Winlogon from sending credentials to network providers.(Citation: EnableMPRNotifications)","relationship_id":"relationship--fc8ef14d-1a07-4f96-85c3-b62ba6bcffc1","references":[{"source_name":"EnableMPRNotifications","description":"Microsoft. (2023, January 26). Policy CSP - WindowsLogon. Retrieved March 30, 2023.","url":"https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowslogon"}]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs. ","relationship_id":"relationship--2686dfb7-60ab-424c-add2-2f164a98cfa4","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Review authentication logs to ensure that mechanisms such as enforcement of MFA are functioning as intended.\n\nPeriodically review the hybrid identity solution in use for any discrepancies. For example, review all Pass Through Authentication (PTA) agents in the Azure Management Portal to identify any unwanted or unapproved ones.(Citation: Mandiant Azure AD Backdoors) If ADFS is in use, review DLLs and executable files in the AD FS and Global Assembly Cache directories to ensure that they are signed by Microsoft. Note that in some cases binaries may be catalog-signed, which may cause the file to appear unsigned when viewing file properties.(Citation: MagicWeb)\n\nPeriodically review for new and unknown network provider DLLs within the Registry (`HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\<NetworkProviderName>\\NetworkProvider\\ProviderPath`). Ensure only valid network provider DLLs are registered. The name of these can be found in the Registry key at `HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order`, and have corresponding service subkey pointing to a DLL at `HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentC ontrolSet\\Services\\<NetworkProviderName>\\NetworkProvider`.","relationship_id":"relationship--f06c48f0-88de-4850-90dd-9ff4979dde95","references":[{"source_name":"MagicWeb","description":"Microsoft Threat Intelligence Center, Microsoft Detection and Response Team, Microsoft 365 Defender Research Team . (2022, August 24). MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone. Retrieved September 28, 2022.","url":"https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/"},{"source_name":"Mandiant Azure AD Backdoors","description":"Mike Burns. (2020, September 30). Detecting Microsoft 365 and Azure Active Directory Backdoors. Retrieved September 28, 2022.","url":"https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1556":"/ttp-simulation/techniques/enterprise/T1556/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1556","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}