T1556 Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- AWS Identity Center Identity Provider Changehightest · aws
- Directory Service Restore Mode(DSRM) Registry Value Tamperinghightest · windows
- Disabling Multi Factor Authenticationhightest · m365
- Github High Risk Configuration Disabledhightest · github
- Possible Shadow Credentials Addedhightest · windows
- Powershell Install a DLL in System Directoryhightest · windows
- CA Policy Removed by Non Approved Actormediumtest · azure
- CA Policy Updated by Non Approved Actormediumtest · azure
- Certificate-Based Authentication Enabledmediumtest · azure
- Change to Authentication Methodmediumtest · azure
- Disabled MFA to Bypass Authentication Mechanismsmediumtest · azure
- Dropping Of Password Filter DLLmediumtest · windows
- New Root Certificate Authority Addedmediumtest · azure
- Okta MFA Reset or Deactivatedmediumtest · okta
- Potential Suspicious Activity Using SeCEditmediumtest · windows
- User Added To Group With CA Policy Modification Accessmediumtest · azure
- User Removed From Group With CA Policy Modification Accessmediumtest · azure
- Cisco Dot1x Disabledmediumexperimental · cisco
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.