ChimeraG0114 ↗
Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.1
tfMITRE ATT&CK sub-technique
Domain Controller Authentication T1556.001
sub-technique of T1556 Modify Authentication Process
- Platform
- Windows
- Version
- 3.0
- Created
- 11 February 2020
- Last modified
- 12 May 2026
Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Domain Controller Authentication MITRE reference T1556.001
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Skeleton KeyS0007 ↗
Is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.1
All 1 software entries for this technique
Offense vs defense T1556.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Domain Controller Authentication detection strategy DET0271
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Domain Controller Authentication Process Modification (Skeleton Key)
1 platform
AN0757 · Windows
Detects anomalous process access to LSASS on domain controllers, suspicious module loads of authentication DLLs, and registry or file modifications indicative of Skeleton Key–style patching. Correlates LSASS access attempts with subsequent abnormal logon activity patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File ModificationDC0061 | WinEventLog:System | Unexpected modification to lsass.exe or cryptdll.dll |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredDLLs | Specific authentication DLLs such as cryptdll.dll and samsrv.dll monitored for tampering. |
| TimeWindow | Correlation window between LSASS memory access, module load, and suspicious logons. |
| UserContext | Baseline expected accounts performing domain controller logon operations. |
Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.
Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
Enabled features, such as Protected Process Light (PPL), for LSA.
User TrainingM1017
Train users to recognize and handle suspicious email attachments. Emphasize the importance of caution when opening attachments from unknown or unexpected sources, even if they appear legitimate. Implement email warning banners to alert users about emails originating from outside the organization or containing attachments, reinforcing awareness and helping users identify potential spearphishing attempts.
Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition