Applied Cybernetics Group
T1550 Use Alternate Authentication Material
- Technique
T1550- Tactics
- Lateral Movement
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 4
- Elastic, Splunk
- 71
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1550
MITRE description
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA) Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through [Credential Access](https://attack.mitre.org/tactics/TA0006) techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-29Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Detection coverage
SigmaHQ community rules
- AWS STS AssumeRole Misuse (core)
- AWS STS GetSessionToken Misuse (core)
- AWS Suspicious SAML Activity (core)
- Outgoing Logon with New Credentials (core)
Elastic and Splunk rules
- Potential Impersonation Attempt via Kubectl (elastic)
- Service Account Token or Certificate Access Followed by Kubernetes API Request (elastic)
- AWS First Occurrence of STS GetFederationToken Request by User (elastic)
- AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure (elastic)
- AWS EC2 Instance Console Login via Assumed Role (elastic)
- AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity (elastic)
- AWS STS AssumeRole with New MFA Device (elastic)
- AWS EKS API Server Proxying Request to Kubelet (elastic)
- AWS STS Role Assumption by Service (elastic)
- AWS STS Role Assumption by User (elastic)
- AWS STS GetFederationToken with AdministratorAccess in Request (elastic)
- AWS STS Role Chaining (elastic)
- Microsoft Graph Email Access by Unusual User and Client (elastic)
- Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP (elastic)
- Entra ID Device-Bound PRT from Unusual Device IP (elastic)
- Entra ID Concurrent Sign-in with Suspicious Properties (elastic)
- Entra ID Windows Hello or Passkey Sign-in from Unregistered Device (elastic)
- Azure AD Graph Access with Unusual Client and User (elastic)
- Entra ID Managed Device Client Sign-In to Graph Enumeration (elastic)
- Entra ID Actor Token User Impersonation Abuse (elastic)
- Entra ID OAuth Device Code Grant by Microsoft Authentication Broker (elastic)
- Entra ID Service Principal Federated Credential Authentication by Unusual Client (elastic)
- Entra ID OAuth Device Code Grant by Unusual User (elastic)
- Entra ID OAuth User Impersonation to Microsoft Graph (elastic)
- Entra ID Kali365 Default User-Agent Detected (elastic)
Showing 25 of 71.