Use Alternate Authentication Material
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
This is a parent whose only observable is already published under a child. AN0954's claim is an absence-correlation -- a logon session for an account that has no matching interactive logon on the host within a window -- which needs a join across event streams plus a not-seen test plus a timeframe, none of which Sigma expresses here. Split into single events, the legs collapse onto neighbours: the Security 4624 leg that actually marks injected credential material is LogonType 9 created by the secondary logon service, which is exactly the published T1550.002 rule in this corpus (id 222885e5-e4e2-4365-a242-183cbb040ff5); the 4648 leg is the same runas artefact viewed from the other side, so a rule on it would duplicate that same behaviour under the parent ID while also matching every scheduled task, mapped drive and management console that supplies explicit credentials; a bare 4624 without […]
What the technique is
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process. Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0954
Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.
- AN0955
Access tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.
- AN0956
Token replay or impersonation in federated logins without interactive browser session or MFA prompts.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.