| ID | Name |
|---|---|
| T1550.001 | Application Access Token |
| T1550.002 | Pass the Hash |
| T1550.003 | Pass the Ticket |
| T1550.004 | Web Session Cookie |
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an
environment and bypass normal system access controls.
攻撃者は、環境内部を横方向に移動し、通常のシステムアクセス制御を回避するために、パスワードハッシュ、Kerberosチケット、アプリケーションアクセストークンなどの代替認証情報を使用する可能性があります。
Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.[1][2]
認証プロセスでは一般に、有効なID（ユーザー名など）と1つ以上の認証要素（パスワード、ピン、物理的なスマートカード、トークンジェネレータなど）が必要とされます。代替認証情報は、ユーザまたはアプリケーションが有効な識別情報および必要な認証要素を提供して認証に成功した後に、システムによって正当に生成さ れます。代替認証情報は、ID 作成プロセス中に生成されることもあります。
Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s).
Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system
access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.
代替認証情報をキャッシュすることで、システムは、ユーザに認証要素の再入力を求めることなく、ID が正常に認証さ
れていることを検証することができます。代替認証は、システムでメモリまたはディスクに格納する必要があるため、クレデンシャル・アクセス・テクニックによって盗まれるリスクがあります。代替認証情報を盗むことで、攻撃者はシステムのアクセス制御を回避し、平文パスワードや追加の認証要素を知らなくてもシステムを認証することができます。
| ID | Name | Description |
|---|---|---|
| G0016 | APT29 |
APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.[3][4] |
| S0661 | FoggyWeb |
FoggyWeb can allow abuse of a compromised AD FS server's SAML token.[5] |
| ID | Mitigation | Description |
|---|---|---|
| M1026 | Privileged Account Management |
Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between
systems. |
| M1018 | User Account Management |
Enforce the principle of least-privilege. Do not allow a domain user to be in the local administrator group on multiple systems. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0026 | Active Directory | Active Directory Credential Request |
Monitor requests of new ticket granting ticket or service tickets to a Domain Controller, such as Windows EID 4769 or 4768, that may use alternate authentication
material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system
access controls. |
| DS0015 | Application Log | Application Log Content |
Monitor for third-party application logging, messaging, and/or other artifacts that may use alternate authentication material, such as password hashes, Kerberos
tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. |
| DS0028 | Logon Session | Logon Session Creation |
Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. |
| DS0002 | User Account | User Account Authentication |
Monitor for an attempt by a user to gain access to a network or computing resource, often by providing credentials that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. |
| DS0006 | Web Credential | Web Credential Usage |
Monitor for an attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202) that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. |