Use Alternate Authentication Material
- ID
- T1550
- Tactics
- TA0008 Lateral Movement
- Platforms
- Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows
- Data sources
- Logon Session Creation, Process Creation, User Account Authentication, Web Credential Usage, Application Log Content, User Account Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.[3][4]
Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.
Sub-techniques (4)
- T1550.001 Application Access Token
- T1550.002 Pass the Hash
- T1550.003 Pass the Ticket
- T1550.004 Web Session Cookie
Detection
- DET0338 Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)
Data components: Logon Session Creation, Process Creation, User Account Authentication, Web Credential Usage, Application Log Content, User Account Metadata
Mitigations (7)
- M1013 Application Developer Guidance
Consider implementing token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, that cryptographically bind a token to a secret. This may prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.[1][2]
- M1015 Active Directory Configuration
Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.
- M1018 User Account Management
Enforce the principle of least-privilege. Do not allow a domain user to be in the local administrator group on multiple systems.
- M1026 Privileged Account Management
Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.
- M1027 Password Policies
Set and enforce secure password policies for accounts.
- M1036 Account Use Policies
Where possible, consider restricting the use of authentication material outside of expected contexts.
- M1047 Audit
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
Software (1)
References
- Microsoft Token Protection 2023
- Okta DPoP 2023
- NIST Authentication
- NIST MFA