Use Alternate Authentication Material `T1550`

Tactic: Lateral Movement

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Events covered

23 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4648	A logon was attempted using explicit credentials.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4768	A Kerberos authentication ticket (TGT) was requested.
Security-Auditing	Event ID 4769	A Kerberos service ticket was requested.
Security-Auditing	Event ID 4776	The domain controller attempted to validate the credentials for an account.
Security-Auditing	Event ID 4887	Certificate Services approved a certificate request and issued a certificate.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5145	A network share object was checked to see whether client can be granted desired access.
ESF	exec	Process Execution
LsaSrv	Event ID 6038	Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server.
LsaSrv	Event ID 6039	Microsoft Windows Server has detected that NTLM authentication is being used between clients and this server.
AppLocker	Event ID 8002	FilePathBuffer was allowed to run.
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

These 133 rules share fields, values, and exclusions.

Fields filtered most (236 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	35	`eq` 32, `in` 3	`azure.signinlogs`, `aws.cloudtrail`, `azure.auditlogs`, `azure.graphactivitylogs`, `okta.system`
`EventType`	24	`eq` 19, `in` 5, `is_not_null` 1	`assumerole`, `sign-in activity`, `assumerolewithwebidentity`, `exec`, `getfederationtoken`
`event.outcome`	21	`eq` 21	`success`
`EventID`	16	`eq` 15, `in` 2	`4768`, `4624`, `4688`, `4769`, `1`
`event.category`	11	`eq` 11	`authentication`, `configuration`, `process`, `network`
`Provider_Name`	10	`eq` 10	`sts.amazonaws.com`, `signin.amazonaws.com`, `lsasrv`
`host.os.type`	10	`eq` 9, `in` 1
`aws::eventName`	9	`eq` 8, `in` 1	`UpdateLoginProfile`, `CreateAccessKey`, `CreateLoginProfile`, `DeleteLoginProfile`, `GetSessionToken`
`aws::eventSource`	9	`eq` 9	`iam.amazonaws.com`, `sts.amazonaws.com`, `signin.amazonaws.com`, `bedrock.amazonaws.com`
`azure_ad::app_id`	9	`eq` 6, `in` 2, `is_not_null` 1	`29d9ed98-a469-4536-ade2-f981bc1d605e`, `00b41c95-dab0-4487-9791-b9d2c32c80f2`, `04b07795-8ddb-461a-bbee-02f9e1bf7b46`, `0ec893e0-5785-4de6-99da-4ed124e5296c`
`azure_ad::user_type`	9	`eq` 8, `is_not_null` 1	`member`, `Member`
`event.dataset`	9	`eq` 9	`aws.cloudtrail`, `github.audit`, `o365.audit`
`event.type`	9	`eq` 7, `in` 1, `ne` 1	`start`, `change`, `access`, `deletion`, `process_started`
`aws::userIdentity.type`	8	`eq` 8	`assumedrole`, `iamuser`, `AssumedRole`, `IAMUser`, `awsservice`
`CommandLine`	7	`contains` 6, `eq` 1, `in` 1, `regex_match` 1	`-cn` , `-computername` , `-cp` , `-p` , `-u`

Top indicator values (757 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS EC2 Instance Console Login via Assumed Role elasticAWS First Occurrence of STS GetFederationToken Request by User elasticAWS Sign-In Token Created elasticAWS STS AssumeRole with New MFA Device elasticAWS STS GetFederationToken with AdministratorAccess in Request elasticAWS STS GetSessionToken Usage elasticAWS STS Role Assumption by Service elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining elasticEntra ID AiTM Phishing-Kit Chain Detected elasticEntra ID Microsoft Authentication Broker Sign-In to Unusual Resource elasticEntra ID OAuth Authorization Code Grant for Unusual User, App, and Resource elasticEntra ID OAuth Device Code Grant by Microsoft Authentication Broker elasticEntra ID OAuth Device Code Grant by Unusual User elasticEntra ID OAuth Device Code Phishing via AiTM +6 more rules	21	369
`data_stream.dataset`	`eq`	`azure.signinlogs` elasticEntra ID ADRS Token Request by Microsoft Authentication Broker elasticEntra ID AiTM Phishing-Kit Chain Detected elasticEntra ID Concurrent Sign-in with Suspicious Properties elasticEntra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN elasticEntra ID Microsoft Authentication Broker Sign-In to Unusual Resource elasticEntra ID OAuth Authorization Code Grant for Unusual User, App, and Resource elasticEntra ID OAuth Device Code Phishing via AiTM elasticEntra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) elasticEntra ID OAuth Phishing via First-Party Microsoft Application elasticEntra ID OAuth PRT Issuance to Non-Managed Device Detected elasticEntra ID OAuth User Impersonation to Microsoft Graph elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client elasticEntra ID Service Principal Federated Credential Authentication by Unusual Client elasticEntra ID User Sign-in with Unusual Authentication Type elasticEntra ID User Sign-in with Unusual Client	15	36
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS EC2 Instance Console Login via Assumed Role elasticAWS First Occurrence of STS GetFederationToken Request by User elasticAWS STS AssumeRole with New MFA Device elasticAWS STS Role Assumption by Service elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining	6	169
`Provider_Name`	`eq`	`sts.amazonaws.com` elasticAWS First Occurrence of STS GetFederationToken Request by User elasticAWS STS AssumeRole with New MFA Device elasticAWS STS GetFederationToken with AdministratorAccess in Request elasticAWS STS GetSessionToken Usage elasticAWS STS Role Assumption by Service elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining	7	11
`key`	`eq`	`user-agent` kustoFirst access credential added to Application or Service Principal where no credential was present kustofull_access_as_app Granted To Application kustoNew access credential added to Application or Service Principal kustoNRT First access credential added to Application or Service Principal where no credential was present kustoNRT New access credential added to Application or Service Principal kustoSuspicious application consent similar to O365 Attack Toolkit kustoSuspicious application consent similar to PwnAuth	7	12
`azure_ad::app_id`	`eq`	`29d9ed98-a469-4536-ade2-f981bc1d605e` elasticEntra ID ADRS Token Request by Microsoft Authentication Broker elasticEntra ID AiTM Phishing-Kit Chain Detected elasticEntra ID Microsoft Authentication Broker Sign-In to Unusual Resource elasticEntra ID OAuth Device Code Phishing via AiTM elasticEntra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) elasticEntra ID OAuth PRT Issuance to Non-Managed Device Detected	6	8
`azure_ad::user_type`	`eq`	`member` elasticEntra ID ADRS Token Request by Microsoft Authentication Broker elasticEntra ID OAuth Authorization Code Grant for Unusual User, App, and Resource elasticEntra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client elasticEntra ID User Sign-in with Unusual Authentication Type elasticEntra ID User Sign-in with Unusual Client	6	11
`LogonType`	`eq`	`NewCredentials` sigmaMimikatz Pass-the-hash login sigmaOutgoing Logon with New Credentials sigmaPass the Hash Activity 2 sigmaSuccessful Overpass the Hash Attempt elasticPotential Pass-the-Hash (PtH) Attempt	5	8
`LogonType`	`eq`	`Network` sigmaPass the Hash Activity 2 elasticPotential Kerberos Relay Attack against a Computer Account splunkPass-the-Hash (Windows Event Log)	3	41
`event.category`	`eq`	`authentication` elasticEntra ID Microsoft Authentication Broker Sign-In to Unusual Resource elasticEntra ID OAuth Device Code Phishing via AiTM elasticEntra ID User Sign-in with Unusual Authentication Type elasticEntra ID User Sign-in with Unusual Client elasticPotential Pass-the-Hash (PtH) Attempt	5	34
`DestinationPort`	`eq`	`88` sigmaUncommon Outbound Kerberos Connection elasticKerberos Traffic from Unusual Process elasticSuspicious Kerberos Authentication Ticket Request splunkUnknown Process Using The Kerberos Protocol	4	7
`EventType`	`eq`	`sign-in activity` elasticEntra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN elasticEntra ID Microsoft Authentication Broker Sign-In to Unusual Resource elasticEntra ID OAuth Device Code Phishing via AiTM elasticEntra ID OAuth Phishing via First-Party Microsoft Application	4	7
`EventType`	`eq`	`assumerole` elasticAWS STS Role Assumption by Service elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining	3	3
`LogonProcessName`	`eq`	`seclogo` sigmaMimikatz Pass-the-hash login sigmaPass the Hash Activity 2 sigmaSuccessful Overpass the Hash Attempt elasticPotential Pass-the-Hash (PtH) Attempt	4	5
`OperationName`	`contains`	`certificates and secrets management` kustoFirst access credential added to Application or Service Principal where no credential was present kustoNew access credential added to Application or Service Principal kustoNRT First access credential added to Application or Service Principal where no credential was present kustoNRT New access credential added to Application or Service Principal	4	6
`OperationName`	`contains`	`add service principal` kustoNew access credential added to Application or Service Principal kustoNRT First access credential added to Application or Service Principal where no credential was present kustoNRT New access credential added to Application or Service Principal	3	4
`Result`	`eq`	`success` kustoFirst access credential added to Application or Service Principal where no credential was present kustoNew access credential added to Application or Service Principal kustoNRT First access credential added to Application or Service Principal where no credential was present kustoNRT New access credential added to Application or Service Principal	4	31
`aws::eventSource`	`eq`	`iam.amazonaws.com` sigmaAWS Suspicious SAML Activity pantherAWS User API Key Created pantherAWS User Login Profile Created or Modified pantherDEPRECATED - AWS User Login Profile Modified	4	28
`aws::eventSource`	`eq`	`sts.amazonaws.com` sigmaAWS STS GetSessionToken Misuse sigmaAWS Suspicious SAML Activity pantherAWS STS GetSessionToken by IAM User	3	6
`displayName`	`contains`	`@` kustoFirst access credential added to Application or Service Principal where no credential was present kustoNew access credential added to Application or Service Principal kustoNRT First access credential added to Application or Service Principal where no credential was present kustoNRT New access credential added to Application or Service Principal	4	5
`displayName`	`eq`	`keydescription` kustoFirst access credential added to Application or Service Principal where no credential was present kustoNew access credential added to Application or Service Principal kustoNRT First access credential added to Application or Service Principal where no credential was present kustoNRT New access credential added to Application or Service Principal	4	5
`event.dataset`	`eq`	`aws.cloudtrail` elasticAWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure elasticAWS Sign-In Token Created elasticAWS STS GetFederationToken with AdministratorAccess in Request elasticAWS STS GetSessionToken Usage	4	17
`event.type`	`eq`	`start` elasticDirect Kubernetes API Request Detected via Defend for Containers elasticKerberos Traffic from Unusual Process elasticPotential Impersonation Attempt via Kubectl elasticPotential Kerberos Attack via Bifrost	4	1078
`type`	`eq`	`application` kustoFirst access credential added to Application or Service Principal where no credential was present kustoNew access credential added to Application or Service Principal kustoNRT First access credential added to Application or Service Principal where no credential was present kustoNRT New access credential added to Application or Service Principal	4	4
`userPrincipalName`	`contains`	`@` kustoFirst access credential added to Application or Service Principal where no credential was present kustoNew access credential added to Application or Service Principal kustoNRT First access credential added to Application or Service Principal where no credential was present kustoNRT New access credential added to Application or Service Principal	4	5
`Category`	`eq`	`applicationmanagement` kustofull_access_as_app Granted To Application kustoSuspicious application consent similar to O365 Attack Toolkit kustoSuspicious application consent similar to PwnAuth	3	13
`OperationName`	`eq`	`consent to application` kustofull_access_as_app Granted To Application kustoSuspicious application consent similar to O365 Attack Toolkit kustoSuspicious application consent similar to PwnAuth	3	5
`aws::userIdentity.type`	`eq`	`assumedrole` sigmaAWS STS AssumeRole Misuse elasticAWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity elasticAWS STS Role Chaining	3	9
`azure.signinlogs.properties.token_protection_status_details.sign_in_session_status`	`eq`	`unbound` elasticEntra ID AiTM Phishing-Kit Chain Detected elasticEntra ID OAuth PRT Issuance to Non-Managed Device Detected elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client	3	4
`azure_ad::authentication_protocol`	`eq`	`devicecode` elasticEntra ID OAuth Device Code Grant by Microsoft Authentication Broker elasticEntra ID OAuth Device Code Grant by Unusual User elasticEntra ID OAuth Device Code Phishing via AiTM	3	3

Exclusions (338 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`wildcard`	`?:\windows\system32\lsass.exe` elasticKerberos Traffic from Unusual Process elasticSuspicious Kerberos Authentication Ticket Request	2
`azure_ad::app_id`	`in`	`29d9ed98-a469-4536-ade2-f981bc1d605e` elasticEntra ID OAuth Device Code Grant by Unusual User elasticEntra ID User Sign-in with Unusual Client	2
`azure_ad::app_id`	`in`	`4813382a-8fa7-425e-ab75-3b753aab3abb` elasticEntra ID OAuth Device Code Grant by Unusual User elasticEntra ID User Sign-in with Unusual Client	2
`azure_ad::app_id`	`in`	`95de633a-083e-42f5-b444-a4295d8e9314` elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client elasticEntra ID User Sign-in with Unusual Client	2
`azure_ad::app_id`	`in`	`9ba1a5c7-f17a-4de9-a1f1-6178c8d51223` elasticEntra ID OAuth Device Code Grant by Unusual User elasticEntra ID User Sign-in with Unusual Client	2
`azure_ad::app_id`	`in`	`ab9b8c07-8f02-4f72-87fa-80105867a763` elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client elasticEntra ID User Sign-in with Unusual Client	2
`azure_ad::app_id`	`in`	`fc0f3af4-6835-4174-b806-f7db311fd2f3` elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client elasticEntra ID User Sign-in with Unusual Client	2
`resultSignature`	`ne`	`SUCCESS` pantherAzure Device Code Authentication with Broker Client pantherAzure Microsoft Graph Single Session from Multiple IP Addresses	2
`source.as.organization.name`	`eq`	`microsoft-corp-msn-as-block` elasticEntra ID User Sign-in with Unusual Authentication Type elasticEntra ID User Sign-in with Unusual Client	2
`AlertName`	`contains`	`0299` kustoUnPAC the hash	1
`AppId`	`in`	`cb1056e2-e479-49de-ae31-7812af012ed8` kustoMicrosoft Entra ID Hybrid Health AD FS Suspicious Application	1
`AppId`	`in`	`cf6d7e68-f018-4e0a-a7b3-126e053fb88d` kustoMicrosoft Entra ID Hybrid Health AD FS Suspicious Application	1
`Esql.azure_signinlogs_properties_app_id_coalesce`	`in`	`00000007-0000-0000-c000-000000000000` elasticEntra ID OAuth User Impersonation to Microsoft Graph	1
`Esql.azure_signinlogs_properties_app_id_coalesce`	`in`	`01fc33a7-78ba-4d2f-a4b7-768e336e890e` elasticEntra ID OAuth User Impersonation to Microsoft Graph	1
`Esql.azure_signinlogs_properties_app_id_coalesce`	`in`	`0ec893e0-5785-4de6-99da-4ed124e5296c` elasticEntra ID OAuth User Impersonation to Microsoft Graph	1

Use Alternate Authentication Material `T1550`

Events covered

Authoring guide

Fields filtered most (236 distinct)

Top indicator values (757 distinct)

Exclusions (338 distinct)

Rules under this technique

Sigma 18 rules

Elastic 61 rules

Splunk 14 rules

Kusto 14 rules

YARA-L 5 rules

Panther 21 rules

Use Alternate Authentication Material T1550

Events covered

Authoring guide

Fields filtered most (236 distinct)

Top indicator values (757 distinct)

Exclusions (338 distinct)

Rules under this technique

Sigma 18 rules

Elastic 61 rules

Splunk 14 rules

Kusto 14 rules

YARA-L 5 rules

Panther 21 rules

Use Alternate Authentication Material `T1550`