Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1556

Modify Authentication Process

IaaS · Identity Provider · Linux · macOS · Network Devices · Office Suite · SaaS · Windows2 pieces on this siteT1556 on attack.mitre.org

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and...

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

3

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

Detect it

1

Hunts and rules you can run, each stating what it needs and what else it returns.

The evidence it leaves

1

Where the traces live, and what each source proves and does not.

how MITRE says to see it

Detect Modification of Authentication Processes Across Platforms

  • Detects modification of LSASS and authentication DLLs, suspicious registry changes to password filter packages, and abnormal process access to lsass.exe. Correlates registry modifications, DLL loads, and process handle access events.
  • Detects modification of PAM configuration files, unauthorized new PAM modules, and suspicious process execution accessing PAM-related binaries. Correlates file modification events in /etc/pam.d/ with process execution of unauthorized binaries.
  • Detects unauthorized additions or changes to /Library/Security/SecurityAgentPlugins and suspicious process activity attempting to hook authentication APIs. Correlates file modifications with abnormal plugin loads in authentication flows.
  • Detects suspicious configuration changes in IdP authentication flows such as enabling reversible password encryption, MFA bypass, or policy weakening. Correlates policy modification events with unusual administrative activity.

what reduces it

  • M1028 Operating System Configuration. Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (`C:\Windows\System32\` by default) of a domain controller and/or local computer with a corresponding entry in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages`.
  • M1025 Privileged Process Integrity. Enabled features, such as Protected Process Light (PPL), for LSA.
  • M1027 Password Policies. Ensure that `AllowReversiblePasswordEncryption` property is set to disabled unless there are application requirements.
  • M1018 User Account Management. Ensure that proper policies are implemented to dictate the the secure enrollment and deactivation of authentication mechanisms, such as MFA, for user accounts.
  • M1022 Restrict File and Directory Permissions. Restrict write access to the `/Library/Security/SecurityAgentPlugins` directory.
  • M1026 Privileged Account Management. Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized.

sub-techniques

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.