Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.(Citation: NIST Authentication)(Citation: NIST MFA)
Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-ptt | Intel Platform Trust Technology | Win 11, Credential Guard | T1550 | Use Alternate Authentication Material |
Comments
Credential Guard uses Intel VT-x for providing Virtualization-based security (VBS), to isolate secrets so that only privileged system software can access them. It isolates LSA-related processes and provides real-time protection against in-memory credential-stealing attempts. NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot (Intel PTT and Intel Boot Guard) and virtualization, to protect credentials.
Credential Guard prevents credential theft attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications such as domain credentials. However, it does not protect against all forms of credential dumping, such as registry dumping. Credential Guard benefits from enabling Secure Boot (BootGuard) and UEFI Lock. When Secure Boot is enabled, a secure and verified environment is established from the start of the boot process. With UEFI Lock, Credential Guard settings are stored in UEFI firmware, significantly increasing the difficulty of disabling Credential Guard through registry changes.
This is marked as significant since it uses VBS to isolate LSA related processes and provide real-time protection against in-memory credential stealing attempts.
References
|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1550 | Use Alternate Authentication Material |
Comments
Intel Threat Detection Technology (TDT) with CrowdStrike Falcon Accelerated Memory Scanning (CAMS) provides security capabilities to enhance cybersecurity defenses. This dynamic solution improves CrowdStrike Falcon by enabling the detection of cyber threats earlier in the kill chain and in real time, with minimal impact on system performance.
Exploits targeting authentication mechanisms, such as those using stolen credentials or bypassing traditional authentication processes, are common tactics for gaining unauthorized access to systems. Intel TDT plays a crucial role by providing deep, real-time detection on program execution, memory access, and control flow at the hardware level. This data helps security teams detect abnormal behaviors, such as suspicious authentication attempts or unauthorized interactions that could indicate misuse of alternate authentication material.
In addition, CAMS offloads the performance-intensive task of memory scanning from the CPU to the Intel Integrated GPU, ensuring faster and more efficient detection of malicious activity. By combining Intel TDT’s with AMS’s memory scanning capabilities, this solution provides powerful defense against evasive exploits that attempt to abuse alternate authentication material, enhancing the protection of critical systems from advanced cyber threats.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1550.003 | Pass the Ticket | 2 |
| T1550.002 | Pass the Hash | 1 |