# T1550 - Use Alternate Authentication Material

## SOC Recommendation
Investigate Use Alternate Authentication Material activity in the context of Lateral Movement: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| User Geolocation Logon Pattern Analysis | Detect | Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique. |
| Credential Hardening | Harden | Apply Credential Hardening to reduce this technique's viability before an incident occurs. |
| Process Termination | Evict | Use Process Termination to remove the adversary's foothold once this technique is confirmed. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
2. Check whether activity aligns with a planned change or approved business process.
3. Identify all affected users/devices/resources over the prior 24 hours.
4. Determine whether this is isolated or part of a broader campaign.
5. Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
6. Elevate severity if privileged identities, critical systems, or repeated activity is observed.
7. Capture all evidence (query results, entities, timeline) in the incident record.
8. Route to the appropriate response playbook and customer escalation path.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain impacted identities/endpoints/sessions based on obse | Low | No | Yes |
| Block malicious indicators (IP, URL, domain, hash) where ava | Medium | No | Yes |
| Complete blast radius analysis across related logs and entit | Low | No | Yes |
| Notify stakeholders according to incident priority and custo | Low | Yes | No |
| Remove persistence or unauthorized access paths identified d | Low | No | Yes |
| Capture lessons learned and update rule tuning/watchlists. | Low | No | Yes |

## KQL
```kql
let BaselinePairs = (
    IdentityLogonEvents
    | where TimeGenerated between (ago(30d) .. ago(1d))
    | where ActionType == "LogonSuccess"
    | where Protocol == "Ntlm"
    | where LogonType == "Network"
    | distinct DeviceName, DestinationDeviceName, AccountName
);
IdentityLogonEvents
| where TimeGenerated >= ago(15m)
| where ActionType == "LogonSuccess"
| where Protocol == "Ntlm"
| where LogonType == "Network"
| where not(AccountName endswith "$")
| join kind=leftanti BaselinePairs on DeviceName, DestinationDeviceName, AccountName
| where not(DeviceName has_any ("sccm", "intune", "mgmt", "monitor", "backup"))
| project
    TimeGenerated, AccountName, AccountDomain,
    DeviceName, DestinationDeviceName,
    Protocol, LogonType, ActionType, FailureReason
| extend timestamp = TimeGenerated,
         HostCustomEntity = DestinationDeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
SecurityEvent
| where TimeGenerated >= ago(5m)
| where EventID == 4769
| where TicketOptions == "0x40810010"
| where IpAddress != "-"
| join kind=inner (
    SecurityEvent
    | where TimeGenerated >= ago(1h)
    | where EventID == 4768
    | extend TGTIpAddress = IpAddress
    | project Account, TGTIpAddress
) on Account
| where IpAddress != TGTIpAddress
| project TimeGenerated, Computer, Account, IpAddress, TGTIpAddress, ServiceName, TicketOptions
| extend timestamp = TimeGenerated,
         HostCustomEntity = Computer,
         AccountCustomEntity = Account,
         IPCustomEntity = IpAddress
| order by TimeGenerated desc
```
```kql
AuditLogs
| where OperationName has ("Certificates and secrets management")
| where Result =~ "success"
| where tostring(InitiatedBy.user.userPrincipalName) has "@" or tostring(InitiatedBy.app.displayName) has "@"
| mv-apply TargetResource = TargetResources on 
  (
      where TargetResource.type =~ "Application"
      | extend targetDisplayName = tostring(TargetResource.displayName),
               targetId = tostring(TargetResource.id),
               targetType = tostring(TargetResource.type),
               keyEvents = TargetResource.modifiedProperties
  )
| mv-apply Property = keyEvents on 
  (
      where Property.displayName =~ "KeyDescription"
      | extend new_value_set = parse_json(tostring(Property.newValue)),
               old_value_set = parse_json(tostring(Property.oldValue))
  )
| where old_value_set == "[]"
| mv-expand new_value_set
| parse new_value_set with * "KeyIdentifier=" keyIdentifier:string ",KeyType=" keyType:string ",KeyUsage=" keyUsage:string ",DisplayName=" keyDisplayName:string "]" *
| where keyUsage =~ "Verify"
| mv-apply AdditionalDetail = AdditionalDetails on 
  (
      where AdditionalDetail.key =~ "User-Agent"
      | extend InitiatingUserAgent = tostring(AdditionalDetail.value)
  )
| project-away new_value_set, old_value_set, TargetResource, Property, AdditionalDetail
| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
| project-reorder TimeGenerated, OperationName, InitiatingUserPrincipalName, InitiatingAadUserId, InitiatingAppName, InitiatingAppServicePrincipalId, InitiatingIpAddress, InitiatingUserAgent, 
targetDisplayName, targetId, targetType, keyDisplayName, keyType, keyUsage, keyIdentifier, CorrelationId, TenantId
| extend Name = split(InitiatingUserPrincipalName, "@")[0], UPNSuffix = split(InitiatingUserPrincipalName, "@")[1]
```

## Escalation Criteria
- Use Alternate Authentication Material activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
- Security testing or red-team exercise — Source identity/host matches approved test plan

Generated by SOC Response Atlas by Basyrix.