SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.12
tfMITRE ATT&CK technique
Use Alternate Authentication Material T1550
- Tactic
- Lateral Movement
- Platforms
- Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows
- Version
- 2.0
- Created
- 30 January 2020
- Last modified
- 12 May 2026
- Contributors
- Blake Strom, Microsoft Threat Intelligence; Pawel Partyka, Microsoft Threat Intelligence
Sub-techniques 429 rules across the family · 10 mapped directly to T1550 · 4 of 4 carry rules
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.10
Detection rules74th pct
Detection rules74th percentile · 74% of ATT&CK techniques have this many detection rules written or fewer.Use Alternate Authentication Material MITRE reference T1550
72nd pctamong all ATT&CK techniques for number of campaigns
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
All 1 campaigns for this technique
Offense vs defense T1550
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 5
first rule: 2021 Q3 · 1 of 1 campaigns plottedUse Alternate Authentication Material detection strategy DET0338
MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)
7 platforms
AN0954 · Windows
Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Allows tuning of how far apart related logon and process events can be correlated |
| UserContext | Customize for high-value or service accounts with restricted access policies |
AN0955 · Linux
Access tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | auditd:SYSCALL | execution of ssh, scp, or sftp using previously unseen credentials or keys |
| Logon Session CreationDC0067 | NSM:Connections | Accepted publickey for user from unusual IP or without tty |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SourceIPWhitelist | Tune for approved jump boxes or bastion hosts |
| AuthMethod | Filter on use of password vs publickey methods for better coverage |
AN0956 · Identity Provider
Token replay or impersonation in federated logins without interactive browser session or MFA prompts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | m365:unified | login using refresh_token with no preceding authentication context |
| Web Credential UsageDC0007 | azure:signinlogs | TokenIssuanceStart, TokenIssuanceSuccess |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MFAContextRequired | Customize for accounts where MFA must always precede token issuance |
| RefreshTokenReuseThreshold | Threshold for number of times a refresh token is reused without re-auth |
AN0957 · SaaS
Unusual reuse of OAuth access tokens from different geographic regions, without full login events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | saas:googleworkspace | API access without user login |
| Web Credential UsageDC0007 | saas:googleworkspace | access_token issued |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GeoIPDistanceThreshold | Minimum distance between token reuse events to trigger detection |
AN0958 · Containers
Container process uses mounted cloud credentials or token cache to authenticate without known orchestration.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account MetadataDC0013 | AWS:CloudTrail | AssumeRole |
| Application Log ContentDC0038 | docker:runtime | execution of cloud CLI tool (e.g., aws, az) inside container |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ContainerLabel | Restrict to prod workloads or certain namespaces |
| CredentialPath | Path used to mount sensitive tokens (e.g., /.aws/credentials) |
AN0959 · Office Suite
Access token reuse to connect to SharePoint or Outlook APIs without interactive user context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Web Credential UsageDC0007 | m365:unified | TokenIssued, FileAccessed |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserAgentCheck | Tune to detect access from CLI agents or scripts rather than interactive browsers |
AN0960 · IaaS
Use of instance metadata tokens across instances or misuse of short-lived tokens issued for different roles.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Web Credential UsageDC0007 | AWS:CloudTrail | GetCallerIdentity |
| User Account MetadataDC0013 | AWS:CloudTrail | AssumeRole |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TokenReuseWindow | Time window where token reuse is suspicious |
| RoleMismatchAlerting | Enable if tokens for RoleA are used in resources only RoleB should access |
Account Use PoliciesM1036
Where possible, consider restricting the use of authentication material outside of expected contexts.
Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.
Consider implementing token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, that cryptographically bind a token to a secret. This may prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.
AuditM1047
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
Password PoliciesM1027
Set and enforce secure password policies for accounts.
Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.
Enforce the principle of least-privilege. Do not allow a domain user to be in the local administrator group on multiple systems.