TA0005 · DEFENSE EVASION
Use Alternate Authentication Material
Pass-the-hash, pass-the-ticket, and stolen web session cookies authenticating without the password.
Detect it with
NTLM logons where Kerberos is expected; a logon with no preceding interactive credential entry.
Why it matters on shift
Use Alternate Authentication Material is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
4 sub-techniques
How it shows up in practice
- T1550.001
Application Access Token
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.
- T1550.002
Pass the Hash
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password.
- T1550.003
Pass the Ticket
Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
- T1550.004
Web Session Cookie
Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.
Kill-chain context