T1187 Forced Authentication — Attack Simulation

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

PetitPotam
windows automated powershell
Procedure 485ce873-2e65-4706-9c7e-ae3ab9e14213; elevation not declared required; cleanup not declared. Not executed or individually validated.
WinPwn - PowerSharpPack - Retrieving NTLM Hashes without Touching LSASS
windows automated powershell
Procedure 7f06b25c-799e-40f1-89db-999c9cc84317; elevation not declared required; cleanup not declared. Not executed or individually validated.
Trigger an authenticated RPC call to a target server with no Sign flag set
windows automated powershell
Procedure 81cfdd7f-1f41-4cc5-9845-bb5149438e37; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows credential-access isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate technique source_mapped

Detection and collection

T1187 detection workspace

Attack tools

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.