Modify Authentication Process T1556
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager…
- Tactics
- Defense Impairment, Persistence, Credential Access
- Actors using it
- 9
- Sub-techniques
- 1
Threat actors
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- Scattered SpiderRoasted 0ktapus, Octo Tempest, Storm-0875 · 50 techniques
- ChimeraChina · 49 techniques
- APT29Russia · IRON RITUAL, IRON HEMLOCK, NobleBaron · 47 techniques
- Salt TyphoonChina · 43 techniques
- FIN13Elephant Beetle · 42 techniques
- MirrorFaceChina · Earth Kasha · 37 techniques
- Storm-050134 techniques
- StriderProjectSauron · 3 techniques