Modify Authentication Process T1556

Tactics: Defense Impairment, Persistence, Credential Access

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Events covered

18 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 154 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (174 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventType32eq 23, in 11exec, ENFORCE_STRONG_AUTHENTICATION, ProcessRollup2, User Risk Detection, exec_event
sourcetype26eq 26cisco:duo:administrator, cisco:duo:activity, OktaIM2:log, aws:asl, aws:cloudtrail
data_stream.dataset25eq 25okta.system, aws.cloudtrail, azure.auditlogs, azure.identity_protection, google_workspace.admin
action17eq 15, in 2policy_create, policy_update, UpdateIPRestrictions, UpdateLoginSettings, business_advanced_security.disabled
host.os.type13eq 13
EventID10eq 9, in 124, 4103, 4104, 4688, 4723
event.type10eq 10start, change, creation, end
process_name10eq 5, in 5, is_not_null 1, ne 1, starts_with 1sshd, ssh, ., azureadconnectauthenticationagentservice.exe, bash
event.outcome9eq 8, in 1success, Success
OperationName8eq 5, contains 3, in 2Add member to group, Add named location, Admin deleted security info, Admin registered security info, Admin updated security info
Provider_Name7eq 7admin, iam.amazonaws.com, rds.amazonaws.com, rolesanywhere.amazonaws.com, sts.amazonaws.com
TargetFilename7starts_with 3, wildcard 3, contains 1, ends_with 1, eq 1, in 1*/.vscode/extensions/*mcp*, */appdata/roaming/cursor/*mcp*, /.claude/, /boot/efi/efi/*/grub.cfg, /boot/grub/grub.cfg
aws::eventName7eq 6, in 1DeactivateMFADevice, DeleteVirtualMFADevice, CreateVirtualMFADevice, AssociateDirectory, Disable Strong Authentication.
eventType7eq 5, contains 1, in 1application.lifecycle.update, user.authentication.auth_via_mfa, application.lifecycle.activate, application.lifecycle.create, system.idp.lifecycle
event.category6eq 6authentication, file, iam

Top indicator values (752 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
sourcetypeeq
cisco:duo:administrator
1010
sourcetypeeq
cisco:duo:activity
44
data_stream.dataseteq
okta.system
948
data_stream.dataseteq
aws.cloudtrail
5141
data_stream.dataseteq
azure.auditlogs
320
data_stream.dataseteq
azure.identity_protection
25
data_stream.dataseteq
google_workspace.admin
218
actioneq
policy_create
88
actioneq
policy_update
89
event.outcomeeq
success
8251
event.typeeq
start
5606
event.typeeq
change
377
event.typeeq
creation
345
"action.name"eq
admin_login
33
EventTypeeq
exec
3171
okta::outcome.resulteq
SUCCESS
39
AppNamestarts_with
ConnectSyncProvisioning_
22
AttributeLDAPDisplayNameeq
msds-keycredentiallink
22
Categoryeq
UserManagement
211
EventTypein
ProcessRollup2
2117
EventTypein
exec
2171
EventTypein
exec_event
2139
OldCredentialNamescross_field_compare
NewCredentialNames
2
Provider_Nameeq
admin
29
Provider_Nameeq
iam.amazonaws.com
225
aws::eventNameeq
CreateVirtualMFADevice
22
aws::eventNameeq
DeactivateMFADevice
22
aws::eventNameeq
DeleteVirtualMFADevice
22
categoryeq
AuditLogs
26
displayNameeq
KeyDescription
26

Exclusions (289 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Imagein
./usr/bin/podman
2
Imagein
/bin/autossl_check
2
Imagein
/bin/chef-client
2
Imagein
/bin/dnf
2
Imagein
/bin/dnf-automatic
2
Imagein
/bin/dockerd
2
Imagein
/bin/dpkg
2
Imagein
/bin/dpkg-divert
2
Imagein
/bin/microdnf
2
Imagein
/bin/pacman
2
Imagein
/bin/pamac-daemon
2
Imagein
/bin/podman
2
Imagein
/bin/puppet
2
Imagein
/bin/rpm
2
Imagein
/bin/snapd
2

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 20 rules

Elastic 42 rules

Splunk 35 rules

Kusto 21 rules

YARA-L 5 rules

Panther 31 rules