1. Home
  2. ATT&CK Techniques
  3. T1556.005 Reversible Encryption

T1556.005 Reversible Encryption

An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The <code>AllowReversiblePasswordEncryption</code> property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.(Citation: store_pwd_rev_enc)

If the property is enabled and/or a user changes their password after it is enabled, an adversary may be able to obtain the plaintext of passwords created/changed after the property was enabled. To decrypt the passwords, an adversary needs four components:

  1. Encrypted password (<code>G$RADIUSCHAP</code>) from the Active Directory user-structure <code>userParameters</code>
  2. 16 byte randomly-generated value (<code>G$RADIUSCHAPKEY</code>) also from <code>userParameters</code>
  3. Global LSA secret (<code>G$MSRADIUSCHAPKEY</code>)
  4. Static key hardcoded in the Remote Access Subauthentication DLL (<code>RASSFM.DLL</code>)

With this information, an adversary may be able to reproduce the encryption key and subsequently decrypt the encrypted password value.(Citation: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2)

An adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory PowerShell module. For example, an adversary may implement and apply a FGPP to users or groups if the Domain Functional Level is set to "Windows Server 2008" or higher.(Citation: dump_pwd_dcsync) In PowerShell, an adversary may make associated changes to user settings using commands similar to <code>Set-ADUser -AllowReversiblePasswordEncryption $true</code>.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.IR-01.05 Remote access protection Mitigates T1556.005 Reversible Encryption
Comments
This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access.
References
    PR.AA-05.02 Privileged system access Mitigates T1556.005 Reversible Encryption
    Comments
    This diagnostic statement protects against Reversible Encryption through the use of privileged account management and the use of multi-factor authentication.
    References
      DE.CM-03.03 Privileged account monitoring Mitigates T1556.005 Reversible Encryption
      Comments
      This diagnostic statement implements mechanisms and tools to mitigate potential misuse of privileged users and accounts. Continuous monitoring of role and attribute assignments and activity is essential to prevent and detect unauthorized access or misuse.
      References
        PR.AA-01.01 Identity and credential management Mitigates T1556.005 Reversible Encryption
        Comments
        This diagnostic statement protects against Reversible Encryption through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
        References

          NIST 800-53 Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          IA-05 Authenticator Management mitigates T1556.005 Reversible Encryption
          AC-02 Account Management mitigates T1556.005 Reversible Encryption
          AC-05 Separation of Duties mitigates T1556.005 Reversible Encryption
          AC-06 Least Privilege mitigates T1556.005 Reversible Encryption

          Azure Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          alerts_for_windows_machines Alerts for Windows Machines technique_scores T1556.005 Reversible Encryption
          Comments
          This control can monitor for command execution related to reversible encryption such as -AllowReversiblePasswordEncryption $true.
          References
          1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers
          2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines

          GCP Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          advanced_protection_program Advanced Protection Program technique_scores T1556.005 Reversible Encryption
          Comments
          Advanced Protection Program enables the use of a security key for multi-factor authentication. Even in the event of compromised credentials, the lack of a security key would prevent an adversary from accessing the account. This leads to significant protection against the technique.
          References
          1. ['https://landing.google.com/advancedprotection/']