{'created': '2020-01-30T16:18:36.873Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may use alternate authentication material, such '
                'as password hashes, Kerberos tickets, and application access '
                'tokens, in order to move laterally within an environment and '
                'bypass normal system access controls. \n'
                '\n'
                'Authentication processes generally require a valid identity '
                '(e.g., username) along with one or more authentication '
                'factors (e.g., password, pin, physical smart card, token '
                'generator, etc.). Alternate authentication material is '
                'legitimately generated by systems after a user or application '
                'successfully authenticates by providing a valid identity and '
                'the required authentication factor(s). Alternate '
                'authentication material may also be generated during the '
                'identity creation process.(Citation: NIST '
                'Authentication)(Citation: NIST MFA)\n'
                '\n'
                'Caching alternate authentication material allows the system '
                'to verify an identity has successfully authenticated without '
                'asking the user to reenter authentication factor(s). Because '
                'the alternate authentication must be maintained by the '
                'system—either in memory or on disk—it may be at risk of being '
                'stolen through [Credential '
                'Access](https://attack.mitre.org/tactics/TA0006) techniques. '
                'By stealing alternate authentication material, adversaries '
                'are able to bypass system access controls and authenticate to '
                'systems without knowing the plaintext password or any '
                'additional authentication factors.\n',
 'external_references': [{'external_id': 'T1550',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1550'},
                         {'description': 'Microsoft. (2016, April 15). Audit '
                                         'Policy Recommendations. Retrieved '
                                         'June 3, 2016.',
                          'source_name': 'TechNet Audit Policy',
                          'url': 'https://technet.microsoft.com/en-us/library/dn487457.aspx'},
                         {'description': 'NIST. (n.d.). Authentication. '
                                         'Retrieved January 30, 2020.',
                          'source_name': 'NIST Authentication',
                          'url': 'https://csrc.nist.gov/glossary/term/authentication'},
                         {'description': 'NIST. (n.d.). Multi-Factor '
                                         'Authentication (MFA). Retrieved '
                                         'September 25, 2024.',
                          'source_name': 'NIST MFA',
                          'url': 'https://csrc.nist.gov/glossary/term/multi_factor_authentication'}],
 'id': 'attack-pattern--51a14c76-dd3b-440b-9c20-2bf91d25a814',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'defense-evasion'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'lateral-movement'}],
 'modified': '2025-10-24T17:48:46.684Z',
 'name': 'Use Alternate Authentication Material',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Blake Strom, Microsoft Threat Intelligence',
                          'Pawel Partyka, Microsoft Threat Intelligence'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows',
                       'SaaS',
                       'IaaS',
                       'Containers',
                       'Identity Provider',
                       'Office Suite',
                       'Linux'],
 'x_mitre_version': '1.5'}