Use Alternate Authentication Material
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or a...
BY SOURCE
PROCEDURES (42)
Auto-extracted: 4 detections for persist
Auto-extracted: 4 detections for aws
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for azure
Auto-extracted: 3 detections for bypass
Auto-extracted: 3 detections for powershell
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for unusual
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for kubernetes
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for kubernetes
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for oauth
Auto-extracted: 1 detections for oauth
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for impersonat
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for impersonat
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for impersonat
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for credential