Home/ MITRE Matrix/ Lateral Movement/ T1550

T1550Use Alternate Authentication Material

T1550 — Use Alternate Authentication Material is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 10 detection use cases covering it and 1 threat-intel article citing it.

Lateral Movement

View on the matrix → Filter Detection Library MITRE official spec ↗

10Use cases

1Articles

4Sub-techniques

1Tactic

Sub-techniques (4)

T1550.001 · Application Access Token T1550.002 · Pass the Hash T1550.003 · Pass the Ticket T1550.004 · Web Session Cookie

Use cases covering this technique (10)

1Password impossible-travel sign-in Internal delivery · alerting DD AWS Console login without MFA + impossible travel Internal delivery · alerting DDCW Impossible travel from application business-logic event Internal delivery · alerting DD AWS Bedrock Invoke Model Access Denied ESCU actions · alerting P Kerberos TGT Request Using RC4 Encryption ESCU actions · alerting P Unknown Process Using The Kerberos Protocol ESCU actions · alerting P Windows AD Suspicious Attribute Modification ESCU actions · alerting P Windows Steal Authentication Certificates - ESC1 Authentication ESCU actions · alerting P aws detect sts get session token abuse ESCU actions · hunting P [LLM] Budibase OIDC login sequence (configs → callback → self) from single source Bespoke exploit · hunting SP

Articles citing this technique (1)

crit [GHSA / CRITICAL] GHSA-hp6v-6jw7-gv2f: Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verifie art-84