T1556No distinct observable

Modify Authentication Process

Defense Impairment · Persistence · Credential AccessIaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Every observable DET0104 offers belongs to a sub-technique or to a different technique entirely, and the one that does not has no usable field vocabulary. AN0287's registry leg is the LSA password-filter and notification-package values under HKLM\SYSTEM\CurrentControlSet\Control\Lsa, which is T1556.002 verbatim; its Sysmon EventID 7 leg is that same password-filter or authentication-package DLL arriving in lsass.exe, so a parent rule on it would publish.002's mechanism under the parent tag; and its Sysmon EventID 10 leg, process handle access to lsass.exe, is credential dumping (T1003.001) rather than modification of the authentication process, so a rule built on it would be mistagged. AN0288 is writes to /etc/pam.d and new PAM modules, which is T1556.003 verbatim. […]

Covered instead by T1556.002, T1556.003, T1003.001.

What the technique is

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts. Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.

Read it on attack.mitre.org

What MITRE says you would watch

AN0287
Detects modification of LSASS and authentication DLLs, suspicious registry changes to password filter packages, and abnormal process access to lsass.exe. Correlates registry modifications, DLL loads, and process handle access events.
AN0288
Detects modification of PAM configuration files, unauthorized new PAM modules, and suspicious process execution accessing PAM-related binaries. Correlates file modification events in /etc/pam.d/ with process execution of unauthorized binaries.
AN0289
Detects unauthorized additions or changes to /Library/Security/SecurityAgentPlugins and suspicious process activity attempting to hook authentication APIs. Correlates file modifications with abnormal plugin loads in authentication flows.