T1550

Use Alternate Authentication Material

Index entry

In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.

View this technique on MITRE ATT&CK →

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

AWS CloudTrail
- AssumeRole
- GetCallerIdentity
Entra ID sign-in logs
- TokenIssuanceStart
- TokenIssuanceSuccess
Docker daemon events and API (the log as a whole)
Google Workspace audit logs (the log as a whole)
Linux audit framework (auditd) (the log as a whole)
Microsoft 365 Unified Audit Log
- FileAccessed
- TokenIssued
Network flow records (Zeek conn, NetFlow, firewall flow) (the log as a whole)
Windows Security event log
- 4624 An account was successfully logged on.
- 4648 A logon was attempted using explicit credentials.
Sysmon
- 1 Process creation

Practice it

1 scenario in this catalog covers T1550. We don't name it, because identifying the technique is part of what a scenario grades. Explore the Range →