Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0338 — Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)
DET0338

Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)

7 analytic(s) · 1 technique(s) detected

Analytics

7
AN0954 Analytic 0954
Windows

Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.

WinEventLog:Security EventCode=4624, 4648 WinEventLog:Sysmon EventCode=1
[TimeWindow] Allows tuning of how far apart related logon and process events can be correlated
[UserContext] Customize for high-value or service accounts with restricted access policies
AN0955 Analytic 0955
Linux

Access tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.

auditd:SYSCALL execution of ssh, scp, or sftp using previously unseen credentials or keys NSM:Connections Accepted publickey for user from unusual IP or without tty
[SourceIPWhitelist] Tune for approved jump boxes or bastion hosts
[AuthMethod] Filter on use of password vs publickey methods for better coverage
AN0956 Analytic 0956
Identity Provider

Token replay or impersonation in federated logins without interactive browser session or MFA prompts.

azure:signinlogs TokenIssuanceStart, TokenIssuanceSuccess m365:unified login using refresh_token with no preceding authentication context
[MFAContextRequired] Customize for accounts where MFA must always precede token issuance
[RefreshTokenReuseThreshold] Threshold for number of times a refresh token is reused without re-auth
AN0957 Analytic 0957
SaaS

Unusual reuse of OAuth access tokens from different geographic regions, without full login events.

saas:googleworkspace access_token issued saas:googleworkspace API access without user login
[GeoIPDistanceThreshold] Minimum distance between token reuse events to trigger detection
AN0958 Analytic 0958
Containers

Container process uses mounted cloud credentials or token cache to authenticate without known orchestration.

docker:runtime execution of cloud CLI tool (e.g., aws, az) inside container AWS:CloudTrail AssumeRole
[ContainerLabel] Restrict to prod workloads or certain namespaces
[CredentialPath] Path used to mount sensitive tokens (e.g., /.aws/credentials)
AN0959 Analytic 0959
Office Suite

Access token reuse to connect to SharePoint or Outlook APIs without interactive user context.

m365:unified TokenIssued, FileAccessed
[UserAgentCheck] Tune to detect access from CLI agents or scripts rather than interactive browsers
AN0960 Analytic 0960
IaaS

Use of instance metadata tokens across instances or misuse of short-lived tokens issued for different roles.

AWS:CloudTrail GetCallerIdentity AWS:CloudTrail AssumeRole
[TokenReuseWindow] Time window where token reuse is suspicious
[RoleMismatchAlerting] Enable if tokens for RoleA are used in resources only RoleB should access

Detected Techniques

1

Details

MITRE ID
DET0338
STIX ID
x-mitre-detection-strategy--2b666abc-e642-4f40-abec-36bd48f1f15c
Analytics
7
Techniques Detected
1
By Tactic
Lateral Movement
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.