Modify Authentication Process `T1556`

Tactics: Defense Impairment, Persistence, Credential Access

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Events covered

21 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4768	A Kerberos authentication ticket (TGT) was requested.
Security-Auditing	Event ID 4882	The security permissions for Certificate Services changed.
Security-Auditing	Event ID 4890	The certificate manager settings for Certificate Services changed.
Security-Auditing	Event ID 4891	A configuration entry changed in Certificate Services.
Security-Auditing	Event ID 4892	A property of Certificate Services changed.
Security-Auditing	Event ID 5136	A directory service object was modified.
1Password-Account	account-disblmfa	Disable Multi-Factor Authentication For All Users
1Password-SSO	any	SSO (catch-all)
1Password-User	any	User (catch-all)
Defender-DeviceFileEvents	FileCreated	File created
Defender-DeviceFileEvents	FileModified	File modified
Defender-DeviceNetworkEvents	ConnectionSuccess	Connection succeeded
ESF	write	File Write
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

These 169 rules share fields, values, and exclusions.

Fields filtered most (193 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	32	`eq` 23, `in` 10	`exec`, `modification`, `ProcessRollup2`, `exec_event`, `user risk detection`
`data_stream.dataset`	27	`eq` 26, `in` 1	`okta.system`, `aws.cloudtrail`, `azure.auditlogs`, `azure.identity_protection`, `azure.signinlogs`
`sourcetype`	26	`eq` 26	`cisco:duo:administrator`, `cisco:duo:activity`, `aws:asl`, `aws:cloudtrail`, `azure:monitor:aad`
`action`	21	`eq` 17, `contains` 2, `in` 2	`policy_create`, `policy_update`, `disblmfa`, `UpdateIPRestrictions`, `UpdateLoginSettings`
`host.os.type`	17	`eq` 17
`event.outcome`	13	`eq` 13	`success`
`event.type`	11	`eq` 11	`start`, `change`, `creation`, `end`
`EventID`	10	`eq` 9, `in` 1	`24`, `4103`, `4104`, `4688`, `4723`
`process_name`	9	`eq` 5, `in` 5, `is_not_null` 1, `starts_with` 1	`sshd`, `ssh`, `.`, `azureadconnectauthenticationagentservice.exe`, `bash`
`OperationName`	8	`eq` 5, `contains` 3, `in` 2	`Add member to group`, `Add named location`, `Delete conditional access policy`, `add service principal`, `admin deleted security info`
`TargetFilename`	7	`starts_with` 3, `wildcard` 3, `contains` 1, `ends_with` 1, `eq` 1, `in` 1, `match` 1	`/.vscode/extensions/mcp`, `/appdata/roaming/cursor/mcp`, `/.claude/`, `/boot/efi/efi/*/grub.cfg`, `/boot/grub/grub.cfg`
`eventType`	7	`eq` 5, `contains` 1, `in` 1	`application.lifecycle.update`, `user.authentication.auth_via_mfa`, `application.lifecycle.activate`, `application.lifecycle.create`, `system.idp.lifecycle`
`type`	7	`eq` 7, `starts_with` 1	`TAILNET`, `2sv_change`, `IdentityProvider`, `POSTURE`, `POSTURE_INTEGRATION`
`Image`	6	`is_not_null` 2, `starts_with` 2, `ends_with` 1, `wildcard` 1	`./`, `./`, `/bin/`, `/boot/`, `/boot/`
`Provider_Name`	6	`eq` 6	`iam.amazonaws.com`, `rds.amazonaws.com`, `rolesanywhere.amazonaws.com`, `sts.amazonaws.com`

Top indicator values (809 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAuthentication via Unusual PAM Grantor elasticAWS IAM Account Password Policy Deleted elasticAWS IAM Deactivation of MFA Device elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token elasticAWS RDS DB Instance Made Public elasticAWS STS AssumeRole with New MFA Device elasticEntra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN elasticEntra ID Conditional Access Policy (CAP) Modified elasticEntra ID Domain Federation Configuration Change elasticEntra ID MFA Disabled for User elasticEntra ID OAuth Application Redirect URI Modified elasticEntra ID User Sign-in with Unusual Authentication Type	13	375
`sourcetype`	`eq`	`cisco:duo:administrator` splunkCisco Duo Bulk Policy Deletion splunkCisco Duo Bypass Code Generation splunkCisco Duo Policy Allow Devices Without Screen Lock splunkCisco Duo Policy Allow Network Bypass 2FA splunkCisco Duo Policy Allow Old Flash splunkCisco Duo Policy Allow Old Java splunkCisco Duo Policy Allow Tampered Devices splunkCisco Duo Policy Bypass 2FA splunkCisco Duo Policy Deny Access splunkCisco Duo Policy Skip 2FA for Other Countries	10	10
`sourcetype`	`eq`	`cisco:duo:activity` splunkCisco Duo Admin Login Unusual Browser splunkCisco Duo Admin Login Unusual Country splunkCisco Duo Admin Login Unusual Os splunkCisco Duo Set User Status to Bypass 2FA	4	4
`data_stream.dataset`	`eq`	`okta.system` elasticAttempt to Deactivate an Okta Policy elasticAttempt to Deactivate an Okta Policy Rule elasticAttempt to Delete an Okta Policy elasticAttempt to Modify an Okta Policy elasticAttempt to Reset MFA Factors for an Okta User Account elasticMFA Deactivation with no Re-Activation for Okta User Account elasticModification or Removal of an Okta Application Sign-On Policy elasticNew Okta Identity Provider (IdP) Added by Admin elasticStolen Credentials Used to Login to Okta Account After MFA Reset	9	48
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS IAM Account Password Policy Deleted elasticAWS IAM Deactivation of MFA Device elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token elasticAWS RDS DB Instance Made Public elasticAWS STS AssumeRole with New MFA Device	6	173
`data_stream.dataset`	`eq`	`azure.auditlogs` elasticEntra ID Conditional Access Policy (CAP) Modified elasticEntra ID Domain Federation Configuration Change elasticEntra ID MFA Disabled for User elasticEntra ID OAuth Application Redirect URI Modified	4	26
`action`	`eq`	`policy_create` splunkCisco Duo Policy Allow Devices Without Screen Lock splunkCisco Duo Policy Allow Network Bypass 2FA splunkCisco Duo Policy Allow Old Flash splunkCisco Duo Policy Allow Old Java splunkCisco Duo Policy Allow Tampered Devices splunkCisco Duo Policy Bypass 2FA splunkCisco Duo Policy Deny Access splunkCisco Duo Policy Skip 2FA for Other Countries	8	8
`action`	`eq`	`policy_update` splunkCisco Duo Policy Allow Devices Without Screen Lock splunkCisco Duo Policy Allow Network Bypass 2FA splunkCisco Duo Policy Allow Old Flash splunkCisco Duo Policy Allow Old Java splunkCisco Duo Policy Allow Tampered Devices splunkCisco Duo Policy Bypass 2FA splunkCisco Duo Policy Deny Access splunkCisco Duo Policy Skip 2FA for Other Countries	8	9
`event.type`	`eq`	`start` elasticPluggable Authentication Module (PAM) Source Download elasticPluggable Authentication Module (PAM) Version Discovery elasticPotential Backdoor Execution Through PAM_EXEC elasticPotential Execution via SSH Backdoor elasticPotential SSH Password Grabbing via strace elasticUnusual SSH Parent/Child Execution	6	1087
`event.type`	`eq`	`change` elasticNetwork Logon Provider Registry Modification elasticPotential Backdoor Execution Through PAM_EXEC elasticRenaming of OpenSSH Binaries	3	95
`event.type`	`eq`	`creation` elasticPluggable Authentication Module (PAM) Creation in Unusual Directory elasticPolkit Policy Creation elasticPotential OpenSSH Backdoor Logging Activity	3	52
`Action`	`eq`	`UPDATE` kustoTailscale: DNS nameservers modified kustoTailscale: MagicDNS disabled kustoTailscale: Policy file (ACL) modified kustoTailscale: Split-DNS configuration modified	4	4
`EventType`	`eq`	`exec` elasticPotential Backdoor Execution Through PAM_EXEC elasticPotential Execution via SSH Backdoor elasticPotential SSH Password Grabbing via strace elasticUnusual SSH Parent/Child Execution	4	579
`EventType`	`eq`	`modification` elasticAuthorization Plugin Modification elasticSuspicious Windows Authentication Registry Modification	2	72
`type`	`eq`	`TAILNET` kustoTailscale: DNS nameservers modified kustoTailscale: MagicDNS disabled kustoTailscale: Policy file (ACL) modified kustoTailscale: Split-DNS configuration modified	4	4
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS IAM Account Password Policy Deleted elasticAWS IAM Deactivation of MFA Device elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token	3	32
`action.name`	`eq`	`admin_login` splunkCisco Duo Admin Login Unusual Browser splunkCisco Duo Admin Login Unusual Country splunkCisco Duo Admin Login Unusual Os	3	3
`log_source`	`eq`	`auditevents` kusto1Password - Changes to SSO configuration kusto1Password - Disable MFA factor or type for all user accounts kusto1Password - User account MFA settings changed	3	12
`AppName`	`starts_with`	`ConnectSyncProvisioning_` kustoDetect changes to Connect Sync Application kustoDetect credential add to Connect Sync Application	2	2
`AttributeLDAPDisplayName`	`eq`	`msds-keycredentiallink` sigmaPossible Shadow Credentials Added elasticPotential Shadow Credentials added to AD Object	2	2
`Category`	`eq`	`usermanagement` sigmaChange to Authentication Method kustoSuspicious Sign In Followed by MFA Modification	2	11
`EventType`	`in`	`ProcessRollup2` elasticPluggable Authentication Module (PAM) Source Download elasticPluggable Authentication Module (PAM) Version Discovery	2	118
`EventType`	`in`	`exec` elasticPluggable Authentication Module (PAM) Source Download elasticPluggable Authentication Module (PAM) Version Discovery	2	206
`EventType`	`in`	`exec_event` elasticPluggable Authentication Module (PAM) Source Download elasticPluggable Authentication Module (PAM) Version Discovery	2	150
`OldCredentialNames`	`cross_field_compare`	`NewCredentialNames` kustoDetect changes to Connect Sync Application kustoDetect credential add to Connect Sync Application	2
`TargetObject`	`wildcard`	`hklm\system\controlset\services\*\networkprovider\providerpath` elasticNetwork Logon Provider Registry Modification elasticSuspicious Windows Authentication Registry Modification	2	2
`aws::eventName`	`eq`	`createvirtualmfadevice` splunkASL AWS New MFA Method Registered For User splunkAWS New MFA Method Registered For User	2	2
`aws::eventName`	`eq`	`deactivatemfadevice` splunkASL AWS Multi-Factor Authentication Disabled splunkAWS Multi-Factor Authentication Disabled	2	2
`aws::eventName`	`eq`	`deletevirtualmfadevice` splunkASL AWS Multi-Factor Authentication Disabled splunkAWS Multi-Factor Authentication Disabled	2	2
`azure_ad::authentication_requirement`	`eq`	`singlefactorauthentication` sigmaAzure AD Only Single Factor Authentication Required elasticEntra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN	2	8

Exclusions (399 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Details`	`eq`	`?:\program files (x86)\citrix\ica client\x64\pnsson.dll` elasticNetwork Logon Provider Registry Modification elasticSuspicious Windows Authentication Registry Modification	2
`Image`	`in`	`./usr/bin/podman` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/autossl_check` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/chef-client` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/dnf` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/dnf-automatic` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/dockerd` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/dpkg` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/dpkg-divert` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/microdnf` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/pacman` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/pamac-daemon` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/podman` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/puppet` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2
`Image`	`in`	`/bin/rpm` elasticPluggable Authentication Module or Configuration Creation elasticPolkit Policy Creation	2

Modify Authentication Process `T1556`

Events covered

Authoring guide

Fields filtered most (193 distinct)

Top indicator values (809 distinct)

Exclusions (399 distinct)

Rules under this technique

Sigma 20 rules

Elastic 46 rules

Splunk 35 rules

Kusto 32 rules

YARA-L 5 rules

Panther 31 rules

Modify Authentication Process T1556

Events covered

Authoring guide

Fields filtered most (193 distinct)

Top indicator values (809 distinct)

Exclusions (399 distinct)

Rules under this technique

Sigma 20 rules

Elastic 46 rules

Splunk 35 rules

Kusto 32 rules

YARA-L 5 rules

Panther 31 rules

Modify Authentication Process `T1556`