T1556 Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- AWS Identity Center Identity Provider Changehightest · aws
- Directory Service Restore Mode(DSRM) Registry Value Tamperinghightest · windows
- Disabling Multi Factor Authenticationhightest · m365
- Github High Risk Configuration Disabledhightest · github
- Possible Shadow Credentials Addedhightest · windows
- Powershell Install a DLL in System Directoryhightest · windows
- CA Policy Removed by Non Approved Actormediumtest · azure
- CA Policy Updated by Non Approved Actormediumtest · azure
- Certificate-Based Authentication Enabledmediumtest · azure
- Change to Authentication Methodmediumtest · azure
- Disabled MFA to Bypass Authentication Mechanismsmediumtest · azure
- Dropping Of Password Filter DLLmediumtest · windows
- New Root Certificate Authority Addedmediumtest · azure
- Okta MFA Reset or Deactivatedmediumtest · okta
- Potential Suspicious Activity Using SeCEditmediumtest · windows
- User Added To Group With CA Policy Modification Accessmediumtest · azure
- User Removed From Group With CA Policy Modification Accessmediumtest · azure
- Cisco Dot1x Disabledmediumexperimental · cisco
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.