Cross-source coverage

T1550 / ATT&CK

Use Alternate Authentication Material

123 rules · 121 families across 10 sources.

From MITRE ATT&CK 19.2

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.

Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.

Platforms
Containers · IaaS · Identity Provider · Linux · Office Suite · SaaS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLNSM:Connectionsazure:signinlogsm365:unifiedsaas:googleworkspacedocker:runtimeAWS:CloudTrail

How MITRE says to detect it DET0338

Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)

Windows Analytic 0954

Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.

  • WinEventLog:Security EventCode=4624, 4648
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 0955

Access tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.

  • auditd:SYSCALL execution of ssh, scp, or sftp using previously unseen credentials or keys
  • NSM:Connections Accepted publickey for user from unusual IP or without tty

Identity Provider Analytic 0956

Token replay or impersonation in federated logins without interactive browser session or MFA prompts.

  • azure:signinlogs TokenIssuanceStart, TokenIssuanceSuccess
  • m365:unified login using refresh_token with no preceding authentication context

SaaS Analytic 0957

Unusual reuse of OAuth access tokens from different geographic regions, without full login events.

  • saas:googleworkspace access_token issued
  • saas:googleworkspace API access without user login

Containers Analytic 0958

Container process uses mounted cloud credentials or token cache to authenticate without known orchestration.

  • docker:runtime execution of cloud CLI tool (e.g., aws, az) inside container
  • AWS:CloudTrail AssumeRole

Office Suite Analytic 0959

Access token reuse to connect to SharePoint or Outlook APIs without interactive user context.

  • m365:unified TokenIssued, FileAccessed

IaaS Analytic 0960

Use of instance metadata tokens across instances or misuse of short-lived tokens issued for different roles.

  • AWS:CloudTrail GetCallerIdentity
  • AWS:CloudTrail AssumeRole

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 123 above — a rule tagged a sub-technique covers this technique too.

elastic/detection-rules

55 rules
Detection Severity Format
Potential Invoke-Mimikatz PowerShell Script Critical Elastic TOML
AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure High Elastic TOML
AWS EC2 Instance Console Login via Assumed Role High Elastic TOML
AWS First Occurrence of STS GetFederationToken Request by User High Elastic TOML
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity High Elastic TOML
AWS STS GetFederationToken with AdministratorAccess in Request High Elastic TOML
Entra ID AiTM Phishing-Kit Chain Detected High Elastic TOML
Entra ID Concurrent Sign-in with Suspicious Properties High Elastic TOML
Entra ID Kali365 Default User-Agent Detected High Elastic TOML
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN High Elastic TOML

+ 45 more from elastic/detection-rules → showing the 10 highest-severity

SigmaHQ/sigma

19 rules
Detection Severity Format
DC Machine Account Network Logon from Non-DC Source IP Critical Sigma
HackTool - Rubeus Execution Critical Sigma
DC Machine Account TGS Request from Non-DC Source IP High Sigma
DC Machine Account TGT Request from Non-DC Source IP High Sigma
HackTool - KrbRelayUp Execution High Sigma
HackTool - Rubeus Execution - ScriptBlock High Sigma
Hacktool Ruler High Sigma
Successful Overpass the Hash Attempt High Sigma
AWS Console GetSigninToken Potential Abuse Medium Sigma
AWS Suspicious SAML Activity Medium Sigma

+ 9 more from SigmaHQ/sigma → showing the 10 highest-severity

panther-labs/panther-analysis

18 rules
Detection Severity Format
DEPRECATED - AWS User Login Profile Modified High Panther Python
GAIA GCPW Credential Theft Attack Chain High Panther Python
Kubernetes Service Account Token Theft from Pod High Panther Python
AppOmni Alert Passthrough Medium Panther Python
AWS Console GetSigninToken Potential Abuse Medium Panther Python
AWS User API Key Created Medium Panther Python
Azure Device Code Authentication with Broker Client Medium Panther Python
Azure Microsoft Graph Single Session from Multiple IP Addresses Medium Panther Python
Enabled Zendesk Support to Assume Users Medium Panther Python
OneLogin Active Login Activity Medium Panther Python

+ 8 more from panther-labs/panther-analysis → showing the 10 highest-severity

splunk/security_content

10 rules
Detection Severity Format
AWS Bedrock Invoke Model Access Denied Undefined SPL
Kerberos TGT Request Using RC4 Encryption Undefined SPL
Mimikatz PassTheTicket CommandLine Parameters Undefined SPL
Okta Multiple Failed Requests to Access Applications Undefined SPL
Rubeus Command Line Parameters Undefined SPL
Rubeus Kerberos Ticket Exports Through Winlogon Access Undefined SPL
Unknown Process Using The Kerberos Protocol Undefined SPL
Windows AD Suspicious Attribute Modification Undefined SPL
Windows Process With NetExec Command Line Parameters Undefined SPL
Windows Steal Authentication Certificates - ESC1 Authentication Undefined SPL

socfortress/Wazuh-Rules

7 rules
Detection Severity Format
Powershell script: Kerberos ticket manipulation detected High Wazuh XML
Sysmon - Event 1: Process creation · Mimikatz Pass-the-Ticket (T1550.003) High Wazuh XML
Sysmon - Event 1: Process creation · PsExec used for Pass-the-Ticket (T1550.003) High Wazuh XML
Sysmon - Event 1: Process creation · PtH via CrackMapExec (T1550.002) High Wazuh XML
Sysmon - Event 1: Process creation · PtH via Invoke-WMIExec (T1550.002) High Wazuh XML
Sysmon - Event 1: Process creation · PtH via Mimikatz (T1550.002) High Wazuh XML
Sysmon - Event 1: Process creation · Rubeus Pass-the-Ticket (T1550.003) High Wazuh XML

Wazuh Core Ruleset

5 rules
Detection Severity Format
Suspicious python script matches Impacket signature, possible use of stolen credentials or pass the hash attack. High Wazuh XML
Windows DC - Possible replay attack High Wazuh XML
Windows DC - Possible replay attack. High Wazuh XML
Successful Remote Logon Detected - User:\ - NTLM authentication, possible pass-the-hash attack - Possible RDP connection. Verify that is allowed to perform RDP connections · win.eventdata.workstationName = .+ Medium Wazuh XML
Successful Remote Logon Detected - User:\ - NTLM authentication, possible pass-the-hash attack. · win.eventdata.authenticationPackageName = NTLM Medium Wazuh XML

chronicle/detection-rules

5 rules
Detection Severity Format
gcp_unauthorized_gke_pod_token_endpoint_usage Medium YARA-L
okta_multiple_failed_requests_to_access_applications Medium YARA-L
aws_lateral_movement_using_iam_session_token Low YARA-L
entra_id_expired_refresh_token_use Low YARA-L
onelogin_multiple_users_assumed Low YARA-L

Azure/Azure-Sentinel

2 rules
Detection Severity Format
Anomalous non-interactive token issuance after interactive sign-in (AiTM pattern) Undefined KQL
Short-window sign-in mismatch between interactive and non-interactive activity Undefined KQL

Bert-JanP/Hunting-Queries-Detection-Rules

1 rule
Detection Severity Format
Kerberos attacks Undefined KQL

elastic/protections-artifacts

1 rule
Detection Severity Format
Potential Kerberos Attack via Bifrost Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.