TA0003 · PERSISTENCE
Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
Detect it with
Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer.
Why it matters on shift
Modify Authentication Process is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
9 sub-techniques
How it shows up in practice
- T1556.001
Domain Controller Authentication
Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.
- T1556.002
Password Filter DLL
Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.
- T1556.003
Pluggable Authentication Modules
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts.
- T1556.004
Network Device Authentication
Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.
- T1556.005
Reversible Encryption
An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems.
- T1556.006
Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
- T1556.007
Hybrid Identity
Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.
- T1556.008
Network Provider DLL
Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process.
- T1556.009
Conditional Access Policies
Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts.
Kill-chain context