Use Alternate Authentication Material T1550
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username)…
- Tactics
- Lateral Movement
- Actors using it
- 17
- Sub-techniques
- 4
Ransomware groups reported using it
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- APT41China · Wicked Panda, Brass Typhoon, BARIUM · 66 techniques
- APT32Vietnam · SeaLotus, OceanLotus, APT-C-00 · 55 techniques
- ChimeraChina · 49 techniques
- Wizard SpiderRussia · UNC1878, TEMP.MixMaster, Grim Spider · 49 techniques
- APT29Russia · IRON RITUAL, IRON HEMLOCK, NobleBaron · 47 techniques
- FIN13Elephant Beetle · 42 techniques
- Ember BearRussia · UNC2589, Bleeding Bear, DEV-0586 · 39 techniques
- ShinyHuntersUNC6240, Bling Libra · 39 techniques
- HAFNIUMChina · Operation Exchange Marauder, Silk Typhoon · 37 techniques
- BRONZE BUTLERChina · REDBALDKNIGHT, Tick · 33 techniques
- TeamPCPPCPCat, ShellForce, DeadCatx3 · 30 techniques
- GALLIUMChina · Granite Typhoon · 27 techniques
- Aquatic PandaChina · 25 techniques
- APT1China · Comment Crew, Comment Group, Comment Panda · 20 techniques
- Star BlizzardRussia · SEABORGIUM, Callisto Group, TA446 · 16 techniques