T1550
Use Alternate Authentication Material
Containers · IaaS · Identity Provider · Linux · Office Suite · SaaS · Windows6 pieces on this siteT1550 on attack.mitre.org
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.).
If this is happening now
Checklists and playbooks to open while the alert is still live.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
A malicious application has consent in the tenant
An unrecognised enterprise application, a consent grant nobody remembers approving, or mail access that survived a password reset.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Cloud identity and token theft detection pack for Entra ID and Okta
Four Sigma rules for the cloud identity attacks that actually land: illicit consent grants, authentication methods added after a risky sign-in, help-desk MFA resets, and session tokens replayed from a second address.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Entra ID sign-in logs
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: the mailbox rule that was not the point
A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.
A domain admin logon from a workstation that has never had one
Twenty minutes. Is this lateral movement, a misconfiguration, or a backup job nobody documented? Name the three pieces of evidence that would settle it, and say what you would do if you could not get any of them.
how MITRE says to see it
Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)
- Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.
- Access tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.
- Token replay or impersonation in federated logins without interactive browser session or MFA prompts.
- Unusual reuse of OAuth access tokens from different geographic regions, without full login events.
what reduces it
- M1013 Application Developer Guidance. Consider implementing token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, that cryptographically bind a token to a secret. This may prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.
- M1027 Password Policies. Set and enforce secure password policies for accounts.
- M1018 User Account Management. Enforce the principle of least-privilege. Do not allow a domain user to be in the local administrator group on multiple systems.
- M1026 Privileged Account Management. Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.
- M1047 Audit. Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
- M1015 Active Directory Configuration. Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.