// MITRE ATT&CK
T1550 · Use Alternate Authentication Material
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) a...
¿Cómo detectarlo y mitigarlo?
La detección de Use Alternate Authentication Material parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (4)
T1550.001
Application Access Token T1550.002
Pass the Hash T1550.003
Pass the Ticket T1550.004
Web Session Cookie
Application Access Token T1550.002
Pass the Hash T1550.003
Pass the Ticket T1550.004
Web Session Cookie
Técnicas relacionadas
T1021.005
VNC T1080
Taint Shared Content T1021.004
SSH T1091
Replication Through Removable Media T1021.008
Direct Cloud VM Connections T1563.001
SSH Hijacking T1021.002
SMB/Windows Admin Shares T1021
Remote Services
VNC T1080
Taint Shared Content T1021.004
SSH T1091
Replication Through Removable Media T1021.008
Direct Cloud VM Connections T1563.001
SSH Hijacking T1021.002
SMB/Windows Admin Shares T1021
Remote Services
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.