Use Alternate Authentication Material
Description
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
AI services commonly use alternate authentication material as a primary means for users to make queries, making them vulnerable to this technique.
- ATLAS ID
- AML.T0091
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Enterprise
Sub-techniques
Mitigations
- AML.M0019Control Access to AI Models and Data in Production
Enforce authorization and monitor production AI API use for anomalous activity associated with replayed access tokens.
Case studies that use it
No ATLAS case study records this technique yet. Browse all case studies.
Related ATT&CK technique
ATLAS adapts this technique from MITRE ATT&CK Enterprise.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-TBAToken-based Authentication1 shared
- D3-TBToken Binding1 shared
- D3-WSAMWeb Session Access Mediation1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared
- D3-PTProcess Termination1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.