Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an au...
BY SOURCE
PROCEDURES (41)
Auto-extracted: 10 detections for authentication monitoring
Auto-extracted: 8 detections for general monitoring
Auto-extracted: 4 detections for bypass
Auto-extracted: 3 detections for credential
Auto-extracted: 3 detections for credential
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for azure
Auto-extracted: 2 detections for cloud
Auto-extracted: 2 detections for registry
Auto-extracted: 2 detections for spray
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for service