Detecting and Mitigating Authentication Process Tampering (T1556)

If an attacker cannot steal your credentials, they can try to change what counts as a valid login. MITRE ATT&CK technique T1556, Modify Authentication Process, covers that. It spans three tactics: defense impairment, persistence and credential access. The platforms are broad: IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS and Windows.

This post covers the parent technique. Nine sub-techniques go deeper, and each has its own post in this series.

How attackers use it

Authentication is handled by specific mechanisms. MITRE names the Local Security Authority Subsystem Service (LSASS) and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on macOS. They gather, store and validate credentials.

By modifying part of that process, an adversary can reveal credentials or bypass authentication entirely, so that access works without using Valid Accounts. Compromised access can defeat controls placed on resources across the network, and can persist against remote systems and externally available services such as VPNs, Outlook Web Access and remote desktop.

The sub-techniques map to each mechanism:

• Domain Controller Authentication (T1556.001)
• Password Filter DLL (T1556.002)
• Pluggable Authentication Modules (T1556.003)
• Network Device Authentication (T1556.004)
• Reversible Encryption (T1556.005)
• Multi-Factor Authentication (T1556.006)
• Hybrid Identity (T1556.007)
• Network Provider DLL (T1556.008)
• Conditional Access Policies (T1556.009)

What they share is position. Each is a place where every login passes through, so a small change there touches every user.

How to detect it

MITRE lists no data sources on this page. Look at the places the sub-techniques target, and watch for change:

• Registry changes on authentication related keys on Windows, and file changes in authentication directories on Linux and macOS.
• New or modified DLLs and libraries loaded by authentication processes.
• Changes to MFA registration, MFA policy and conditional access settings in your identity provider's audit log.
• Logins that succeed in ways that do not match policy, for example a success with no MFA event where one is required.
• Any change to authentication related components outside a patch window.

An inventory of authentication components with hashes gives you something to compare against. Without a baseline, you cannot tell a patched module from a backdoored one.

How to reduce the risk

MITRE lists these mitigations for the parent technique.

1. Restrict registry permissions. Disallow modification of sensitive keys such as HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order.
2. Multi-factor authentication. MFA greatly reduces the risk of an adversary gaining valid credentials for initial access, lateral movement and collection. It can also restrict access to cloud resources and APIs.
3. Password policies. Keep the AllowReversiblePasswordEncryption property disabled unless an application requires it.
4. Restrict file and directory permissions. Restrict write access to the /Library/Security/SecurityAgentPlugins directory on macOS.
5. User account management. Set policy for the secure enrollment and deactivation of authentication mechanisms such as MFA.

Check your own environment

Read-only checks, labeled by platform.

# Windows: who is registered as a network provider, in order
reg query "HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" /v ProviderOrder

# Windows: registered password filters and other LSA notification packages
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" | Select-Object -ExpandProperty "Notification Packages"

# Windows AD: accounts with reversible encryption enabled
Get-ADUser -Filter 'AllowReversiblePasswordEncryption -eq $true' -Properties AllowReversiblePasswordEncryption | Select-Object SamAccountName

# Linux: review PAM configuration for the SSH service
cat /etc/pam.d/sshd

# macOS: list authorization plugins directory contents
ls -l /Library/Security/SecurityAgentPlugins

Look for unfamiliar providers, unfamiliar notification packages, any reversible encryption accounts, and any PAM module or plugin you cannot trace to a vendor.

Quick check

Sources

• MITRE ATT&CK T1556 Modify Authentication Process