1200KM / simulation
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is…
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.[NIST Authentication][NIST MFA]
Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.
Official technique definition · Open in the interactive matrix
Related pages are navigation context. Their tools, rules and lab results are not automatically inherited.
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.
Required normalized fields: service, action, actor, record_count, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0038",
"collector": "illustrative-lab-collector",
"observation": {
"service": "lab-portal",
"action": "export_requested",
"actor": "lab-reader",
"record_count": 3,
"result": "authorized"
}
}Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.
DC0067 collection page — Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.
Required normalized fields: account, logon_id, logon_type, source_ip.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0067",
"collector": "illustrative-lab-collector",
"observation": {
"account": "LAB\\analyst",
"logon_id": "0x12345",
"logon_type": 3,
"source_ip": "192.0.2.10"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0002 collection page — Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.
Required normalized fields: account, application, result, reason, source_ip.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0002",
"collector": "illustrative-lab-collector",
"observation": {
"account": "analyst@example.test",
"application": "lab-portal",
"result": "failure",
"reason": "invalid_credential",
"source_ip": "192.0.2.10"
}
}Visibility limits: A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.
DC0013 collection page — Export an authorized directory/account inventory with stable IDs, roles, enabled state and collection time; compare snapshots without exposing credentials.
Required normalized fields: account_id, enabled, roles, inventory_time.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0013",
"collector": "illustrative-lab-collector",
"observation": {
"account_id": "user-lab-1",
"enabled": true,
"roles": [
"lab-reader"
],
"inventory_time": "2026-09-27T12:00:00Z"
}
}Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
DC0007 collection page — Join workload/non-interactive sign-in or application access records to non-secret credential identifiers and resource results.
Required normalized fields: credential_id, resource, action, result, source_ip.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0007",
"collector": "illustrative-lab-collector",
"observation": {
"credential_id": "key-lab-1",
"resource": "lab-api",
"action": "authenticate",
"result": "success",
"source_ip": "192.0.2.10"
}
}Visibility limits: A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.
Open the dedicated detection workspace · Existing query engineering
Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.
Platforms: Windows.
Access tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.
Platforms: Linux.
Token replay or impersonation in federated logins without interactive browser session or MFA prompts.
Platforms: Identity Provider.
Unusual reuse of OAuth access tokens from different geographic regions, without full login events.
Platforms: SaaS.
Container process uses mounted cloud credentials or token cache to authenticate without known orchestration.
Platforms: Containers.
Access token reuse to connect to SharePoint or Outlook APIs without interactive user context.
Platforms: Office Suite.
Use of instance metadata tokens across instances or misuse of short-lived tokens issued for different roles.
Platforms: IaaS.
4 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.
No exact technique-specific Atlas model is present for T1550 in the selected source snapshot. The following is a design worksheet, not a newly validated model.
Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
No reviewed lab-tool association is selected for this exact technique. This is a curation gap, not a statement that no tool can implement the behavior.
These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.
FoggyWeb can allow abuse of a compromised AD FS server's SAML token.[MSTIC FoggyWeb September 2021]
Exact relationship: relationship--6ee04a90-7158-43a6-8133-9b498f1fef2cAtomic evidence: no compatible candidate in this snapshot. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
No compatible Atomic procedure is present in this pinned evidence set. Technical feasibility has not been ruled out. A custom procedure must define the behavior, target, collection point, success observable and rollback before execution.
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Use Alternate Authentication Material, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
Consider implementing token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, that cryptographically bind a token to a secret. This may prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.[Microsoft Token Protection 2023][Okta DPoP 2023]
Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.
Enforce the principle of least-privilege. Do not allow a domain user to be in the local administrator group on multiple systems.
Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.
Set and enforce secure password policies for accounts.
Where possible, consider restricting the use of authentication material outside of expected contexts.
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
No reviewed association in this snapshot.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.