tfMITRE ATT&CK technique

Use Alternate Authentication Material T1550

Tactic: Lateral Movement
Platforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows
Version: 2.0
Created: 30 January 2020
Last modified: 12 May 2026
Contributors: Blake Strom, Microsoft Threat Intelligence; Pawel Partyka, Microsoft Threat Intelligence

Sub-techniques 429 rules across the family · 10 mapped directly to T1550 · 4 of 4 carry rules

.001Application Access Token4 .002Pass the Hash6 .003Pass the Ticket11 .004Web Session Cookie1

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules74th pct

Detection rules74th percentile · 73% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1550

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 5

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Logon Session CreationDC0067

WinEventLog:Security

EventCode=4624, 4648

Field	What you tune
TimeWindow	Allows tuning of how far apart related logon and process events can be correlated
UserContext	Customize for high-value or service accounts with restricted access policies

Field

What you tune

TimeWindow

Allows tuning of how far apart related logon and process events can be correlated

UserContext

Customize for high-value or service accounts with restricted access policies

Data component	Name	Channel
User Account AuthenticationDC0002	auditd:SYSCALL	execution of ssh, scp, or sftp using previously unseen credentials or keys
Logon Session CreationDC0067	NSM:Connections	Accepted publickey for user from unusual IP or without tty

Field	What you tune
SourceIPWhitelist	Tune for approved jump boxes or bastion hosts
AuthMethod	Filter on use of password vs publickey methods for better coverage

Data component	Name	Channel
User Account AuthenticationDC0002	m365:unified	login using refresh_token with no preceding authentication context
Web Credential UsageDC0007	azure:signinlogs	TokenIssuanceStart, TokenIssuanceSuccess

Field	What you tune
MFAContextRequired	Customize for accounts where MFA must always precede token issuance
RefreshTokenReuseThreshold	Threshold for number of times a refresh token is reused without re-auth

Data component	Name	Channel
User Account AuthenticationDC0002	saas:googleworkspace	API access without user login
Web Credential UsageDC0007	saas:googleworkspace	access_token issued

Use Alternate Authentication Material T1550

Use Alternate Authentication Material T1550

Use Alternate Authentication Material MITRE reference T1550

Offense vs defense T1550

Use Alternate Authentication Material detection strategy DET0338

Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Use Alternate Authentication Material MITRE reference T1550

Offense vs defense T1550

Use Alternate Authentication Material detection strategy DET0338

Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Use Alternate Authentication Material detections T1550

Use Alternate Authentication Material detections T1550

Data component	Name	Channel
User Account MetadataDC0013	AWS:CloudTrail	AssumeRole
Application Log ContentDC0038	docker:runtime	execution of cloud CLI tool (e.g., aws, az) inside container

Field	What you tune
ContainerLabel	Restrict to prod workloads or certain namespaces
CredentialPath	Path used to mount sensitive tokens (e.g., /.aws/credentials)

Data component	Name	Channel
Web Credential UsageDC0007	AWS:CloudTrail	GetCallerIdentity
User Account MetadataDC0013	AWS:CloudTrail	AssumeRole

Field	What you tune
TokenReuseWindow	Time window where token reuse is suspicious
RoleMismatchAlerting	Enable if tokens for RoleA are used in resources only RoleB should access

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic identifies access denied error when attempting to invoke AWS Bedrock models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Lateral Movement Use Alternate Authentication Material Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	c53a8e62-f741-11ee-9f6e-acde48001122
	Identifies the suspicious use of AssumeRole. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Privilege Escalation Abuse Elevation Control Mechanism Lateral Movement Use Alternate Authentication Material Application Access Token	-	low	Austin Songer @austinsonger	2021-07-24	2022-10-09	905d389b-b853-46d0-9d3d-dea0d3a3cd49
	Identifies the suspicious use of GetSessionToken. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Privilege Escalation Abuse Elevation Control Mechanism Lateral Movement Use Alternate Authentication Material Application Access Token	-	low	Austin Songer @austinsonger	2021-07-24	2022-10-09	b45ab1d2-712f-4f01-a751-df3826969807
	Identifies when suspicious SAML activity has occurred in AWS. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Privilege Escalation Abuse Elevation Control Mechanism Lateral Movement Use Alternate Authentication Material Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer	2021-09-22	2022-12-18	f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Splunk	The following analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. (...)	Generic	stable	authentication	windows	WinEventLog Security	Lateral Movement Use Alternate Authentication Material	-	medium	Mauricio Velazco, Splunk	2022-03-08	2026-05-13	18916468-9c04-11ec-bdc6-acde48001122
	Detects logon events that specify new credentials	Generic	test	authentication	windows	WinEventLog Security	Lateral Movement Use Alternate Authentication Material	-	low	Max Altgelt (Nextron Systems)	2022-04-06	—	def8b624-e08f-4ae1-8612-1ba21190da6b
Splunk	The following analytic identifies a non-lsass.exe process making an outbound connection on port 88, which is typically used by the Kerberos authentication protocol. (...)	Generic	stable	process_creation	windows	Sysmon	Lateral Movement Use Alternate Authentication Material	-	medium	Mauricio Velazco, Splunk	2022-03-10	2026-05-13	c91a0852-9fbb-11ec-af44-acde48001122
	Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.	Placeholder	test	authentication	windows	WinEventLog Security	Credential Access Steal or Forge Authentication Certificates Credential Access Steal or Forge Kerberos Tickets Lateral Movement Use Alternate Authentication Material	-	low	frack113	2022-10-14	2023-12-14	94309181-d345-4cbf-b5fe-061769bdf9cb
Splunk	This detection monitors changes to the following Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink", "scriptPath", and "msTSInitialProgram". (...)	Generic	stable	account_management	windows	WinEventLog Security	Defense Impairment File and Directory Permissions Modification Windows Permissions Lateral Movement Use Alternate Authentication Material	-	medium	Dean Luxton	2024-07-01	2026-05-13	5682052e-ce55-4f9f-8d28-59191420b7e0
Splunk	The following analytic detects when a suspicious certificate with a Subject Alternative Name (SAN) is issued using Active Directory Certificate Services (AD CS) and then immediately used for authentication. (...)	Generic	stable	account_management	windows	WinEventLog Security	Credential Access Steal or Forge Authentication Certificates Lateral Movement Use Alternate Authentication Material	-	medium	Steven Dick	2023-07-28	2026-05-13	f0306acf-a6ab-437a-bbc6-8628f8d5c97e