{ "technique_id": "T1550", "name": "Use Alternate Authentication Material", "priority": "medium", "status": "complete", "version": "0.1.0", "last_reviewed": "2026-07-23", "generated_by": "SOC Response Atlas by Basyrix", "tactics": [ "Lateral Movement" ], "platforms": [ "Containers", "IaaS", "Identity Provider", "Linux", "Office Suite", "SaaS", "Windows" ], "summary": "Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.)...", "soc_recommendation": "Investigate Use Alternate Authentication Material activity in the context of Lateral Movement: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.", "d3fend_mappings": [ { "id": "D3-UGLPA", "name": "User Geolocation Logon Pattern Analysis", "relationship": "detect", "practical_action": "Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-CH", "name": "Credential Hardening", "relationship": "harden", "practical_action": "Apply Credential Hardening to reduce this technique's viability before an incident occurs.", "tooling": [ "Entra ID" ] }, { "id": "D3-PT", "name": "Process Termination", "relationship": "evict", "practical_action": "Use Process Termination to remove the adversary's foothold once this technique is confirmed.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-NTF", "name": "Network Traffic Filtering", "relationship": "isolate", "practical_action": "Apply Network Traffic Filtering to contain the blast radius once this technique is observed.", "tooling": [ "Sentinel", "Defender for Endpoint" ] } ], "investigation_steps": { "microsoft": [ "Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.", "Check whether activity aligns with a planned change or approved business process.", "Identify all affected users/devices/resources over the prior 24 hours.", "Determine whether this is isolated or part of a broader campaign.", "Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.", "Elevate severity if privileged identities, critical systems, or repeated activity is observed.", "Capture all evidence (query results, entities, timeline) in the incident record.", "Route to the appropriate response playbook and customer escalation path." ], "generic": [ "Confirm whether the observed use alternate authentication material activity matches expected administrative or application behaviour.", "Identify the host, account, or resource where the activity occurred and its business criticality.", "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.", "Real detection reference: \"Pass-the-Hash NTLM Auth Anomaly\" -- Flags NTLM network authentication between a device pair that has not communicated via NTLM in the prior 30 days - consistent with Pass-the-Hash using a captured NTLM hash. Requires Defender for Identity (IdentityLogonEvents)." ] }, "evidence_to_collect": [ "Host or resource affected", "Account or identity involved", "Timestamp of the activity", "Related process, file, or network artifact", "Any preceding or follow-on alerts" ], "response_actions": [ { "name": "Contain impacted identities/endpoints/sessions based on obse", "category": "Containment", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Contain impacted identities/endpoints/sessions based on observed behavior." }, { "name": "Block malicious indicators (IP, URL, domain, hash) where ava", "category": "Containment", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Block malicious indicators (IP, URL, domain, hash) where available." }, { "name": "Complete blast radius analysis across related logs and entit", "category": "Eradication", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Complete blast radius analysis across related logs and entities." }, { "name": "Notify stakeholders according to incident priority and custo", "category": "Eradication", "risk": "Low", "automation_safe": true, "approval_required": false, "tool": "See investigation guide", "notes": "Notify stakeholders according to incident priority and customer SLA." }, { "name": "Remove persistence or unauthorized access paths identified d", "category": "Recovery", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Remove persistence or unauthorized access paths identified during investigation." }, { "name": "Capture lessons learned and update rule tuning/watchlists.", "category": "Recovery", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide" } ], "queries": { "kql": [ { "name": "GEN-LM-004 — Pass-the-Hash NTLM Auth Anomaly", "description": "Flags NTLM network authentication between a device pair that has not communicated via NTLM in the prior 30 days - consistent with Pass-the-Hash using a captured NTLM hash. Requires Defender for Identity (IdentityLogonEvents). (Source: Bell Integration baseline detection library, mapped via sub-technique T1550.002.)", "query": "let BaselinePairs = (\n IdentityLogonEvents\n | where TimeGenerated between (ago(30d) .. ago(1d))\n | where ActionType == \"LogonSuccess\"\n | where Protocol == \"Ntlm\"\n | where LogonType == \"Network\"\n | distinct DeviceName, DestinationDeviceName, AccountName\n);\nIdentityLogonEvents\n| where TimeGenerated >= ago(15m)\n| where ActionType == \"LogonSuccess\"\n| where Protocol == \"Ntlm\"\n| where LogonType == \"Network\"\n| where not(AccountName endswith \"$\")\n| join kind=leftanti BaselinePairs on DeviceName, DestinationDeviceName, AccountName\n| where not(DeviceName has_any (\"sccm\", \"intune\", \"mgmt\", \"monitor\", \"backup\"))\n| project\n TimeGenerated, AccountName, AccountDomain,\n DeviceName, DestinationDeviceName,\n Protocol, LogonType, ActionType, FailureReason\n| extend timestamp = TimeGenerated,\n HostCustomEntity = DestinationDeviceName,\n AccountCustomEntity = AccountName\n| order by TimeGenerated desc" }, { "name": "GEN-LM-007 — Pass-the-Ticket Kerberos Reuse", "description": "Flags a Kerberos service ticket used from a different IP than the one where the ticket-granting ticket (TGT) was issued - consistent with an extracted-and-replayed ticket (Mimikatz sekurlsa::tickets / kerberos::ptt). (Source: Bell Integration baseline detection library, mapped via sub-technique T1550.003.)", "query": "SecurityEvent\n| where TimeGenerated >= ago(5m)\n| where EventID == 4769\n| where TicketOptions == \"0x40810010\"\n| where IpAddress != \"-\"\n| join kind=inner (\n SecurityEvent\n | where TimeGenerated >= ago(1h)\n | where EventID == 4768\n | extend TGTIpAddress = IpAddress\n | project Account, TGTIpAddress\n) on Account\n| where IpAddress != TGTIpAddress\n| project TimeGenerated, Computer, Account, IpAddress, TGTIpAddress, ServiceName, TicketOptions\n| extend timestamp = TimeGenerated,\n HostCustomEntity = Computer,\n AccountCustomEntity = Account,\n IPCustomEntity = IpAddress\n| order by TimeGenerated desc" }, { "name": "2cfc3c6e-f424-4b88-9cc9-c89f482d016a — First access credential added to Application or Service Principal where no credential was present", "description": "This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where there was no previous verify KeyCredential associated. If a threat actor obtains access to an account with sufficient privileges and adds the alternate authentication material triggering this event, the threat actor can now authenticate as the Application or Service Principal using this credential. Additional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow For further information on AuditLogs please see https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1550.001.)", "query": "AuditLogs\n| where OperationName has (\"Certificates and secrets management\")\n| where Result =~ \"success\"\n| where tostring(InitiatedBy.user.userPrincipalName) has \"@\" or tostring(InitiatedBy.app.displayName) has \"@\"\n| mv-apply TargetResource = TargetResources on \n (\n where TargetResource.type =~ \"Application\"\n | extend targetDisplayName = tostring(TargetResource.displayName),\n targetId = tostring(TargetResource.id),\n targetType = tostring(TargetResource.type),\n keyEvents = TargetResource.modifiedProperties\n )\n| mv-apply Property = keyEvents on \n (\n where Property.displayName =~ \"KeyDescription\"\n | extend new_value_set = parse_json(tostring(Property.newValue)),\n old_value_set = parse_json(tostring(Property.oldValue))\n )\n| where old_value_set == \"[]\"\n| mv-expand new_value_set\n| parse new_value_set with * \"KeyIdentifier=\" keyIdentifier:string \",KeyType=\" keyType:string \",KeyUsage=\" keyUsage:string \",DisplayName=\" keyDisplayName:string \"]\" *\n| where keyUsage =~ \"Verify\"\n| mv-apply AdditionalDetail = AdditionalDetails on \n (\n where AdditionalDetail.key =~ \"User-Agent\"\n | extend InitiatingUserAgent = tostring(AdditionalDetail.value)\n )\n| project-away new_value_set, old_value_set, TargetResource, Property, AdditionalDetail\n| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)\n| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)\n| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\n| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)\n| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))\n| project-reorder TimeGenerated, OperationName, InitiatingUserPrincipalName, InitiatingAadUserId, InitiatingAppName, InitiatingAppServicePrincipalId, InitiatingIpAddress, InitiatingUserAgent, \ntargetDisplayName, targetId, targetType, keyDisplayName, keyType, keyUsage, keyIdentifier, CorrelationId, TenantId\n| extend Name = split(InitiatingUserPrincipalName, \"@\")[0], UPNSuffix = split(InitiatingUserPrincipalName, \"@\")[1]" } ], "spl": [], "esql": [ { "name": "b8c7d6e5-f4a3-4b2c-9d8e-7f6a5b4c3d2e — AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure", "description": "(ESQL) Detects AWS access keys that are used from both GitHub Actions CI/CD infrastructure and non-CI/CD infrastructure. This pattern indicates potential credential theft where an attacker who has stolen AWS credentials configured as GitHub Actions secrets and is using them from their own infrastructure. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "from logs-aws.cloudtrail-* metadata _id, _version, _index\n\n| WHERE event.dataset == \"aws.cloudtrail\"\n AND aws.cloudtrail.user_identity.access_key_id IS NOT NULL\n AND @timestamp >= NOW() - 7 days\n AND source.as.organization.name IS NOT NULL\n\n// AWS API key used from github actions \n| EVAL is_aws_github = user_agent.original LIKE \"*aws-credentials-for-github-actions\"\n\n// non CI/CD related ASN \n| EVAL is_not_cicd_infra = not source.as.organization.name IN (\"Microsoft Corporation\", \"Amazon.com, Inc.\", \"Amazon Technologies Inc.\", \"Google LLC\")\n\n| STATS Esql.is_github_aws_key = MAX(CASE(is_aws_github, 1, 0)),\n Esql.has_suspicious_asn = MAX(CASE(is_not_cicd_infra, 1, 0)),\n Esql.last_seen_suspicious_asn = MAX(CASE(is_not_cicd_infra, @timestamp, NULL)),\n Esql.source_ip_values = VALUES(source.address), \n Esql.source_asn_values = VALUES(source.as.organization.name) BY aws.cloudtrail.user_identity.access_key_id, user.name, cloud.account.id\n\n// AWS API key tied to a GH action used from unusual ASN (non CI/CD infra)\n| WHERE Esql.is_github_aws_key == 1 AND Esql.has_suspicious_asn == 1 \n\n // avoid alert duplicates within 1h interval\n AND Esql.last_seen_suspicious_asn >= NOW() - 1 hour\n\n| KEEP user.name, aws.cloudtrail.user_identity.access_key_id, Esql.*" }, { "name": "a1b2c3d4-e5f6-4789-a0b1-c2d3e4f5a6b7 — AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity", "description": "(ESQL) Detects when credentials issued through `AssumeRoleWithWebIdentity` for a Kubernetes service account identity are later used for several distinct AWS control-plane actions on the same session access key... (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "FROM logs-aws.cloudtrail-*\n| WHERE (event.action == \"AssumeRoleWithWebIdentity\" AND user.name like \"system:serviceaccount:*\")\n // S3 PutObject/GetObject is too common in legit pod SA behavior \n OR (event.action IN (\"ListBuckets\", \"DescribeInstances\", \"GetCallerIdentity\",\n \"ListUsers\", \"ListRoles\", \"ListAttachedRolePolicies\", \"GetRolePolicy\",\n \"GetSecretValue\", \"ListSecrets\",\n \"GetParameters\", \"DescribeParameters\", \"ListKeys\", \"Decrypt\",\n \"ListFunctions\", \"GetAuthorizationToken\",\n \"SendCommand\", \"StartSession\",\n \"CreateUser\", \"CreateAccessKey\", \"AttachRolePolicy\", \"CreateRole\",\n \"PutRolePolicy\", \"UpdateAssumeRolePolicy\",\n \"UpdateFunctionCode\", \"UpdateFunctionConfiguration\", \"ModifyInstanceAttribute\",\n \"StopLogging\", \"DeleteTrail\")\n AND aws.cloudtrail.user_identity.type == \"AssumedRole\")\n| GROK aws.cloudtrail.response_elements \"accessKeyId=%{NOTSPACE:issued_key_id},\"\n| EVAL access_key = COALESCE(issued_key_id, aws.cloudtrail.user_identity.access_key_id)\n| EVAL is_assume = CASE(event.action == \"AssumeRoleWithWebIdentity\", 1, 0)\n| EVAL is_post_exploit = CASE(event.action != \"AssumeRoleWithWebIdentity\", 1, 0)\n| EVAL phase = CASE(\n event.action == \"AssumeRoleWithWebIdentity\", \"initial_access\",\n event.action IN (\"ListBuckets\", \"DescribeInstances\", \"ListUsers\", \"ListRoles\",\n \"GetCallerIdentity\", \"ListAttachedRolePolicies\", \"GetRolePolicy\",\n \"ListFunctions\"), \"recon\",\n event.action IN (\"GetSecretValue\", \"ListSecrets\", \"GetParameters\",\n \"GetAuthorizationToken\", \"Decrypt\"), \"credential_access\",\n event.action IN (\"SendCommand\", \"StartSession\"), \"lateral_movement\",\n event.action IN (\"CreateUser\", \"CreateAccessKey\", \"AttachRolePolicy\",\n \"CreateRole\", \"PutRolePolicy\", \"UpdateAssumeRolePolicy\",\n \"UpdateFunctionCode\", \"UpdateFunctionConfiguration\",\n \"ModifyInstanceAttribute\"), \"persistence\",\n event.action IN (\"StopLogging\", \"DeleteTrail\"), \"defense_evasion\"\n )\n| STATS \n Esql.assume_count = SUM(is_assume),\n Esql.post_exploit_count = COUNT_DISTINCT(event.action),\n Esql.attack_phases = VALUES(phase),\n Esql.event_action_values = VALUES(event.action),\n Esql.source_ip_values = VALUES(source.ip),\n Esql.source_as_organization_name_values = VALUES(source.as.organization.name),\n Esql.user_name_values = VALUES(user.name),\n Esql.user_agent_original_values = VALUES(user_agent.original),\n Esql.cloud_account_id_values = VALUES(cloud.account.id),\n Esql.data_stream_namespace_values = VALUES(data_stream.namespace),\n Esql.first_seen = MIN(@timestamp),\n Esql.last_seen = MAX(@timestamp),\n Esql.total_calls = COUNT(*)\n BY access_key\n| WHERE access_key is not null and Esql.assume_count >= 1 AND Esql.post_exploit_count >= 3\n| EVAL aws.cloudtrail.user_identity.access_key_id = MV_FIRST(access_key)\n| KEEP aws.cloudtrail.user_identity.access_key_id, Esql.*" } ] }, "automation": { "safe": [ "Add recommendation as Sentinel incident comment.", "Run enrichment queries.", "Create ServiceNow SecOps task." ], "approval_required": [ "Contain or disable the affected host/account.", "Any change to production configuration." ] }, "escalation_criteria": [ "Use Alternate Authentication Material activity observed on a privileged account or critical system.", "Activity follows or precedes other suspicious behaviour in the same investigation.", "Automated triage cannot confidently rule out malicious intent." ], "false_positive_considerations": [ "Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners", "Security testing or red-team exercise — Source identity/host matches approved test plan" ], "confluence": { "title": "T1550 - Use Alternate Authentication Material Response Guidance", "labels": [ "mitre", "attack", "d3fend", "secops", "basyrix" ], "sections": [ "summary", "d3fend_mappings", "investigation_steps", "response_actions", "queries", "automation", "escalation_criteria", "false_positive_considerations" ] } }