{"id":"T1556","name":"Modify Authentication Process","url":"https://attack.mitre.org/techniques/T1556","tactics":["defense-impairment","persistence","credential-access"],"platforms":["IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0104","stix_id":"x-mitre-detection-strategy--d51dd574-9171-4c46-89bc-0e3bb1178dfe","name":"Detect Modification of Authentication Processes Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0104","analytics":[{"id":"AN0287","stix_id":"x-mitre-analytic--818b46ce-9c93-47c9-a649-8bc5d3b734a5","name":"Analytic 0287","description":"Detects modification of LSASS and authentication DLLs, suspicious registry changes to password filter packages, and abnormal process access to lsass.exe. Correlates registry modifications, DLL loads, and process handle access events.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0287","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4657","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"MonitoredRegistryKeys","description":"Specific LSASS and password filter registry paths monitored for modification."},{"field":"TimeWindow","description":"Correlation window between registry change, DLL load, and lsass.exe access."}],"live":true,"detection_strategies":["DET0104"],"techniques":["T1556"]},{"id":"AN0288","stix_id":"x-mitre-analytic--776b9173-cbe0-4d1e-8ac9-af19b3db9dd7","name":"Analytic 0288","description":"Detects modification of PAM configuration files, unauthorized new PAM modules, and suspicious process execution accessing PAM-related binaries. Correlates file modification events in /etc/pam.d/ with process execution of unauthorized binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0288","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open, write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"WatchedPaths","description":"Critical PAM directories and configuration files monitored for modification."}],"live":true,"detection_strategies":["DET0104"],"techniques":["T1556"]},{"id":"AN0289","stix_id":"x-mitre-analytic--ee0f60f3-2fb3-4857-b02e-58c69b5aab52","name":"Analytic 0289","description":"Detects unauthorized additions or changes to /Library/Security/SecurityAgentPlugins and suspicious process activity attempting to hook authentication APIs. Correlates file modifications with abnormal plugin loads in authentication flows.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0289","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"SecurityAgentPlugins modification","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"process_open","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"PluginPaths","description":"List of approved authentication plugin directories to baseline."}],"live":true,"detection_strategies":["DET0104"],"techniques":["T1556"]},{"id":"AN0290","stix_id":"x-mitre-analytic--bbaa7fb3-974c-41ef-9cec-a0789a66445c","name":"Analytic 0290","description":"Detects suspicious configuration changes in IdP authentication flows such as enabling reversible password encryption, MFA bypass, or policy weakening. Correlates policy modification events with unusual administrative activity.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0290","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:policy","channel":"UpdatePolicy","data_component":"DC0069","data_component_name":"Cloud Service Modification","log_source_slug":"azure-policy"},{"name":"m365:unified","channel":"Set-ADUser OR Set-ADAccountControl","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"PolicyBaseline","description":"Expected authentication-related policy configurations to compare against."}],"live":true,"detection_strategies":["DET0104"],"techniques":["T1556"]},{"id":"AN0291","stix_id":"x-mitre-analytic--20b6d23a-d1cc-494c-ac67-e7358835c674","name":"Analytic 0291","description":"Detects unauthorized changes to IAM authentication configurations such as disabling MFA, creating backdoor access keys, or altering trust policies. Correlates identity policy updates with unusual login behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0104#AN0291","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"UpdateLoginProfile","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"UpdateAccountPasswordPolicy","data_component":"DC0069","data_component_name":"Cloud Service Modification","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"ApprovedAccounts","description":"Baseline list of service accounts expected to modify IAM authentication policies."}],"live":true,"detection_strategies":["DET0104"],"techniques":["T1556"]}],"live":true,"version":"1.0","techniques":["T1556"]}],"sigma_rules":[{"id":"26e7c5e2-6545-481e-b7e6-050143459635","title":"CA Policy Removed by Non Approved Actor","author":"Corissa Koopmans, '@corissalea'","status":"test","level":"medium","date":"2022-07-19","modified":null,"description":"Monitor and alert on conditional access changes where non approved actor removed CA Policy.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.credential-access","attack.persistence","attack.defense-impairment","attack.t1548","attack.t1556"],"path":"rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml","techniques":["T1548","T1556"],"cves":[]},{"id":"4bb80281-3756-4ec8-a88e-523c5a6fda9e","title":"New Root Certificate Authority Added","author":"Harjot Shah Singh, '@cyb3rjy0t'","status":"test","level":"medium","date":"2024-03-26","modified":null,"description":"Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.","references":["https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f","https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.credential-access","attack.persistence","attack.privilege-escalation","attack.defense-impairment","attack.t1556"],"path":"rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml","techniques":["T1556"],"cves":[]},{"id":"4d78a000-ab52-4564-88a5-7ab5242b20c7","title":"Change to Authentication Method","author":"AlertIQ","status":"test","level":"medium","date":"2021-10-10","modified":"2022-12-25","description":"Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.credential-access","attack.defense-impairment","attack.t1556","attack.persistence","attack.t1098"],"path":"rules/cloud/azure/audit_logs/azure_change_to_authentication_method.yml","techniques":["T1556","T1098"],"cves":[]},{"id":"50a3c7aa-ec29-44a4-92c1-fce229eef6fc","title":"CA Policy Updated by Non Approved Actor","author":"Corissa Koopmans, '@corissalea'","status":"test","level":"medium","date":"2022-07-19","modified":"2024-05-28","description":"Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare \"old\" vs \"new\" value.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.credential-access","attack.persistence","attack.defense-impairment","attack.t1548","attack.t1556"],"path":"rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml","techniques":["T1548","T1556"],"cves":[]},{"id":"665e2d43-70dc-4ccc-9d27-026c9dd7ed9c","title":"User Removed From Group With CA Policy Modification Access","author":"Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'","status":"test","level":"medium","date":"2022-08-04","modified":null,"description":"Monitor and alert on group membership removal of groups that have CA policy modification access","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.credential-access","attack.persistence","attack.defense-impairment","attack.t1548","attack.t1556"],"path":"rules/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml","techniques":["T1548","T1556"],"cves":[]},{"id":"7ea78478-a4f9-42a6-9dcd-f861816122bf","title":"Disabled MFA to Bypass Authentication Mechanisms","author":"@ionsor","status":"test","level":"medium","date":"2022-02-08","modified":"2026-04-30","description":"Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.","references":["https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates","https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory","https://research.splunk.com/cloud/482dd42a-acfa-486b-a0bb-d6fcda27318e/","https://analyticsrules.exchange/analyticrules/65c78944-930b-4cae-bd79-c3664ae30ba7/","https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.credential-access","attack.persistence","attack.defense-impairment","attack.t1556"],"path":"rules/cloud/azure/audit_logs/azure_mfa_disabled.yml","techniques":["T1556"],"cves":[]},{"id":"8622c92d-c00e-463c-b09d-fd06166f6794","title":"Github High Risk Configuration Disabled","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"high","date":"2023-01-29","modified":"2024-07-22","description":"Detects when a user disables a critical security feature for an organization.","references":["https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization","https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions","https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository","https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"],"logsource":{"product":"github","service":"audit"},"tags":["attack.credential-access","attack.persistence","attack.defense-impairment","attack.t1556"],"path":"rules/application/github/audit/github_disable_high_risk_configuration.yml","techniques":["T1556"],"cves":[]},{"id":"91c95675-1f27-46d0-bead-d1ae96b97cd3","title":"User Added To Group With CA Policy Modification Access","author":"Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'","status":"test","level":"medium","date":"2022-08-04","modified":null,"description":"Monitor and alert on group membership additions of groups that have CA policy modification access","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.credential-access","attack.persistence","attack.defense-impairment","attack.t1548","attack.t1556"],"path":"rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml","techniques":["T1548","T1556"],"cves":[]},{"id":"b61e87c0-50db-4b2e-8986-6a2be94b33b0","title":"Directory Service Restore Mode(DSRM) Registry Value Tampering","author":"Nischal Khadgi","status":"test","level":"high","date":"2024-07-11","modified":null,"description":"Detects changes to \"DsrmAdminLogonBehavior\" registry value.\nDuring a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure.\nAttackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory.\nIf the \"DsrmAdminLogonBehavior\" value is set to \"0\", the administrator account can only be used if the DC starts in DSRM.\nIf the \"DsrmAdminLogonBehavior\" value is set to \"1\", the administrator account can only be used if the local AD DS service is stopped.\nIf the \"DsrmAdminLogonBehavior\" value is set to \"2\", the administrator account can always be used.\n","references":["https://adsecurity.org/?p=1785","https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.credential-access","attack.persistence","attack.defense-impairment","attack.t1556"],"path":"rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml","techniques":["T1556"],"cves":[]},{"id":"c2496b41-16a9-4016-a776-b23f8910dc58","title":"Certificate-Based Authentication Enabled","author":"Harjot Shah Singh, '@cyb3rjy0t'","status":"test","level":"medium","date":"2024-03-26","modified":null,"description":"Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.","references":["https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f","https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.credential-access","attack.persistence","attack.privilege-escalation","attack.defense-impairment","attack.t1556"],"path":"rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml","techniques":["T1556"],"cves":[]},{"id":"d3adb3ef-b7e7-4003-9092-1924c797db35","title":"AWS Identity Center Identity Provider Change","author":"Michael McIntyre @wtfender","status":"test","level":"high","date":"2023-09-27","modified":null,"description":"Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.\nA change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.\n","references":["https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html","https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html","https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.persistence","attack.credential-access","attack.defense-impairment","attack.t1556"],"path":"rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml","techniques":["T1556"],"cves":[]},{"id":"f598ea0c-c25a-4f72-a219-50c44411c791","title":"Possible Shadow Credentials Added","author":"Nasreddine Bencherchali (Nextron Systems), Elastic (idea)","status":"test","level":"high","date":"2022-10-17","modified":null,"description":"Detects possible addition of shadow credentials to an active directory object.","references":["https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html","https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/","https://twitter.com/SBousseaden/status/1581300963650187264?"],"logsource":{"product":"windows","service":"security"},"tags":["attack.persistence","attack.credential-access","attack.defense-impairment","attack.t1556"],"path":"rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml","techniques":["T1556"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2020-8193","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-12812","state":"mapped","mapping_types":["exploitation_technique","primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}