Modify Authentication Process

T1556

Technique with 9 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.

Detection rules50

Rules on DetectionCode tagged with T1556 or one of its sub-techniques.

Sigma19

Rule	Level	Log source	Technique
AWS Identity Center Identity Provider Change	high	aws / NULL	T1556
Directory Service Restore Mode(DSRM) Registry Value Tampering	high	windows / registry_set	T1556
Disabling Multi Factor Authentication	high	m365 / NULL	T1556.006
Github High Risk Configuration Disabled	high	github / NULL	T1556
Possible Shadow Credentials Added	high	windows / NULL	T1556
Powershell Install a DLL in System Directory	high	windows / ps_script	T1556.002
CA Policy Removed by Non Approved Actor	medium	azure / NULL	T1556
CA Policy Updated by Non Approved Actor	medium	azure / NULL	T1556
Certificate-Based Authentication Enabled	medium	azure / NULL	T1556
Change to Authentication Method	medium	azure / NULL	T1556
Cisco Dot1x Disabled	medium	cisco / NULL	T1556.004
Disabled MFA to Bypass Authentication Mechanisms	medium	azure / NULL	T1556
Dropping Of Password Filter DLL	medium	windows / process_creation	T1556.002
New Root Certificate Authority Added	medium	azure / NULL	T1556
Okta MFA Reset or Deactivated	medium	okta / NULL	T1556.006
Potential Suspicious Activity Using SeCEdit	medium	windows / process_creation	T1556.002
User Added To Group With CA Policy Modification Access	medium	azure / NULL	T1556
User Removed From Group With CA Policy Modification Access	medium	azure / NULL	T1556
Azure AD Only Single Factor Authentication Required	low	azure / NULL	T1556.006

Splunk31

Rule	Type	Risk	Data source	Technique
ASL AWS Multi-Factor Authentication Disabled	TTP	NULL	ASL AWS CloudTrail	T1556.006
ASL AWS New MFA Method Registered For User	TTP	NULL	ASL AWS CloudTrail	T1556.006
AWS Multi-Factor Authentication Disabled	TTP	NULL	AWS CloudTrail DeleteVirtualMFADevice, AWS CloudTrail DeactivateMFADevice	T1556.006
AWS New MFA Method Registered For User	TTP	NULL	AWS CloudTrail CreateVirtualMFADevice	T1556.006
Azure AD Multi-Factor Authentication Disabled	TTP	NULL	Azure Active Directory Disable Strong Authentication	T1556.006
Azure AD New MFA Method Registered For User	TTP	NULL	Azure Active Directory User registered security info	T1556.006
Cisco ASA - AAA Policy Tampering	Anomaly	NULL	Cisco ASA Logs	T1556.004
Cisco Duo Admin Login Unusual Browser	TTP	NULL	Cisco Duo Activity	T1556
Cisco Duo Admin Login Unusual Country	TTP	NULL	Cisco Duo Activity	T1556
Cisco Duo Admin Login Unusual Os	TTP	NULL	Cisco Duo Activity	T1556
Cisco Duo Bulk Policy Deletion	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Bypass Code Generation	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Policy Allow Devices Without Screen Lock	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Policy Allow Network Bypass 2FA	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Policy Allow Old Flash	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Policy Allow Old Java	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Policy Allow Tampered Devices	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Policy Bypass 2FA	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Policy Deny Access	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Policy Skip 2FA for Other Countries	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Duo Set User Status to Bypass 2FA	TTP	NULL	Cisco Duo Administrator	T1556
Cisco Network Interface Modifications	Anomaly	NULL	Cisco IOS Logs	T1556
Disabling Windows Local Security Authority Defences via Registry	TTP	NULL	Sysmon EventID 13	T1556
GCP Multi-Factor Authentication Disabled	TTP	NULL	Google Workspace	T1556.006
O365 Disable MFA	TTP	NULL	O365 Disable Strong Authentication.	T1556
O365 Excessive SSO logon errors	Anomaly	NULL	O365 UserLoginFailed	T1556
Okta Multi-Factor Authentication Disabled	TTP	NULL	Okta	T1556.006
Okta Phishing Detection with FastPass Origin Check	TTP	NULL	Okta	T1556
PingID Mismatch Auth Source and Verification Response	TTP	NULL	PingID	T1556.006
PingID New MFA Method After Credential Reset	TTP	NULL	PingID	T1556.006
PingID New MFA Method Registered For User	TTP	NULL	PingID	T1556.006

Sub-techniques9

ID	Name	Examples
T1556.001	Domain Controller Authentication	2
T1556.002	Password Filter DLL	4
T1556.003	Pluggable Authentication Modules	2
T1556.004	Network Device Authentication	3
T1556.005	Reversible Encryption	0
T1556.006	Multi-Factor Authentication	4
T1556.007	Hybrid Identity	2
T1556.008	Network Provider DLL	0
T1556.009	Conditional Access Policies	2

Groups1

FIN13

Software4

DRYHOOK Ebury Kessel SILENTTRINITY

Campaigns1

ArcaneDoor

Procedure examples6

Groups1

Used by	Procedure example
GroupFIN13	FIN13 has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications. Mandiant FIN13 Aug 2022

Software4

Used by	Procedure example
MalwareDRYHOOK	DRYHOOK has intercepted and logged user credentials by modifying the Perl module in Ivanti Connect Secure VPN edge-devices located within `/home/perl/DSAuth.pm`. Google UNC5221 Ivanti January 2025 Picus Security UNC5221 Ivanti May 2025
MalwareEbury	Ebury can intercept private keys using a trojanized `ssh-add` function. ESET Ebury Feb 2014
MalwareKessel	Kessel has trojanized the <sode>ssh_login</code> and `user-auth_pubkey` functions to steal plaintext credentials. ESET ForSSHe December 2018
ToolSILENTTRINITY	SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook. GitHub SILENTTRINITY Modules July 2019

Campaigns1

Used by	Procedure example
CampaignArcaneDoor	ArcaneDoor included modification of the AAA process to bypass authentication mechanisms. Cisco ArcaneDoor 2024

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.