{
  "technique_id": "T1556",
  "name": "Modify Authentication Process",
  "tactics": [
    "Defense Impairment",
    "Persistence",
    "Credential Access"
  ],
  "platforms": [
    "IaaS",
    "Identity Provider",
    "Linux",
    "macOS",
    "Network Devices",
    "Office Suite",
    "SaaS",
    "Windows"
  ],
  "summary": "Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials...",
  "generated_by": "SOC Response Atlas by Basyrix"
}