// MITRE ATT&CK
T1556 · Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) ...
How to detect & mitigate it
Detecting Modify Authentication Process starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Sub-techniques (9)
T1556.001
Domain Controller Authentication T1556.002
Password Filter DLL T1556.003
Pluggable Authentication Modules T1556.004
Network Device Authentication T1556.005
Reversible Encryption T1556.006
Multi-Factor Authentication T1556.007
Hybrid Identity T1556.008
Network Provider DLL T1556.009
Conditional Access Policies
Domain Controller Authentication T1556.002
Password Filter DLL T1556.003
Pluggable Authentication Modules T1556.004
Network Device Authentication T1556.005
Reversible Encryption T1556.006
Multi-Factor Authentication T1556.007
Hybrid Identity T1556.008
Network Provider DLL T1556.009
Conditional Access Policies
Related techniques
T1687
Exploitation for Defense Impairment T1556.003
Pluggable Authentication Modules T1578.004
Revert Cloud Instance T1222.002
Linux and Mac Permissions T1666
Modify Cloud Resource Hierarchy T1685.003
Modify or Spoof Tool UI T1685.001
Disable or Modify Windows Event Log T1578
Modify Cloud Compute Infrastructure
Exploitation for Defense Impairment T1556.003
Pluggable Authentication Modules T1578.004
Revert Cloud Instance T1222.002
Linux and Mac Permissions T1666
Modify Cloud Resource Hierarchy T1685.003
Modify or Spoof Tool UI T1685.001
Disable or Modify Windows Event Log T1578
Modify Cloud Compute Infrastructure
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.