📓
📓
📓
📓
Red Team Notes 2.0
Search…
📓
📓
📓
📓
Red Team Notes 2.0
Introduction
Red Team
Red Team Techniques
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
T1497: Virtualization/Sandbox Evasion
T1550: Use Alternate Authentication Material
Pass the Ticket
Pass the Hash
T1127: Trusted Developer Utilities Proxy Execution
T1221: Template Injection
T1553: Subvert Trust Controls
T1216: Signed Script Proxy Execution
T1218: Signed Binary Proxy Execution
T1055: Process Injection
T0127: Obfuscated Files or Information
T1036: Masquerading
T1202: Indirect Command Execution
T1562: Impair Defenses
T1070: Indicator Removal on Host
T1574: Hijack Execution Flow
T1564: Hide Artifacts
T1222: File Directory Permissions Modification
T1480: Execution Guardrails
T1197: BITS Jobs
T1134: Access Token Manipulation
T1548: Abuse Elevation Control Mechanism
De-obfuscate/Decode Files or Information
Credential Access
Discovery
Lateral Movement
Active Directory
Active Directory
Active Directory Attacks
Red Team Infrastructure
RED TEAM INFRASTRUCTURE
Domain Name and Categorization
Reconnaissance
Weaponization
Delivery
Situational Awareness
Credential Dumping
Persistence
Defense Evasion
Privilege Escalation
Lateral Movement
Powered By GitBook
T1550: Use Alternate Authentication Material
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process.
Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication material allows the system to verify an identity has successfully
Previous
System Checks
Next
Pass the Ticket
Last modified 1yr ago
Copy link