T1556PersistenceDefense ImpairmentCredential Access
Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports0
Detections
12 Sigma rules tagged T1556Modify Authentication ProcessT155612 general rules
- AWS Identity Center Identity Provider Changehightest
- Directory Service Restore Mode(DSRM) Registry Value Tamperinghightest
- Github High Risk Configuration Disabledhightest
- Possible Shadow Credentials Addedhightest
- CA Policy Removed by Non Approved Actormediumtest
- CA Policy Updated by Non Approved Actormediumtest
- Certificate-Based Authentication Enabledmediumtest
- Change to Authentication Methodmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Modify Authentication Process
2 CVEs, by priority. Each link shows its badge.- CVE-2020-12812Fortinet FortiOS SSL VPN Improper Authentication VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited45.4%Top 1.2%78.5priority
- CVE-2020-8193Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass VulnerabilityCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVPublic exploitMedium · 6.5T1556Modify Authentication ProcessT1005Data from Local SystemMITRE CTID mapping of the KEV entry · how it is exploited88.3%Top 0.23%67.5priority