MITRE ATT&CK technique · defense-impairment, Persistence, Credential Access

`T1556.007` Hybrid Identity

Sub-technique of T1556 Modify Authentication Process

Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts. Many organizations maintain hybrid user and device identities that are shared between on-premises and cloud-based environments. These can be maintained…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT29

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.