{'created': '2020-02-11T19:01:56.887Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may modify authentication mechanisms and '
                'processes to access user credentials or enable otherwise '
                'unwarranted access to accounts. The authentication process is '
                'handled by mechanisms, such as the Local Security '
                'Authentication Server (LSASS) process and the Security '
                'Accounts Manager (SAM) on Windows, pluggable authentication '
                'modules (PAM) on Unix-based systems, and authorization '
                'plugins on MacOS systems, responsible for gathering, storing, '
                'and validating credentials. By modifying an authentication '
                'process, an adversary may be able to authenticate to a '
                'service or system without using [Valid '
                'Accounts](https://attack.mitre.org/techniques/T1078).\n'
                '\n'
                'Adversaries may maliciously modify a part of this process to '
                'either reveal credentials or bypass authentication '
                'mechanisms. Compromised credentials or access may be used to '
                'bypass access controls placed on various resources on systems '
                'within the network and may even be used for persistent access '
                'to remote systems and externally available services, such as '
                'VPNs, Outlook Web Access and remote desktop.',
 'external_references': [{'external_id': 'T1556',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1556'},
                         {'description': 'Bialek, J. (2013, September 15). '
                                         'Intercepting Password Changes With '
                                         'Function Hooking. Retrieved November '
                                         '21, 2017.',
                          'source_name': 'Clymb3r Function Hook Passwords Sept '
                                         '2013',
                          'url': 'https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/'},
                         {'description': 'Chris Ross. (2018, October 17). '
                                         'Persistent Credential Theft with '
                                         'Authorization Plugins. Retrieved '
                                         'April 22, 2021.',
                          'source_name': 'Xorrior Authorization Plugins',
                          'url': 'https://xorrior.com/persistent-credential-theft/'},
                         {'description': 'Dell SecureWorks. (2015, January '
                                         '12). Skeleton Key Malware Analysis. '
                                         'Retrieved April 8, 2019.',
                          'source_name': 'Dell Skeleton',
                          'url': 'https://www.secureworks.com/research/skeleton-key-malware-analysis'},
                         {'description': 'Metcalf, S. (2015, November 22). '
                                         'Dump Clear-Text Passwords for All '
                                         'Admins in the Domain Using Mimikatz '
                                         'DCSync. Retrieved November 15, 2021.',
                          'source_name': 'dump_pwd_dcsync',
                          'url': 'https://adsecurity.org/?p=2053'},
                         {'description': 'Microsoft. (2016, April 15). Audit '
                                         'Policy Recommendations. Retrieved '
                                         'June 3, 2016.',
                          'source_name': 'TechNet Audit Policy',
                          'url': 'https://technet.microsoft.com/en-us/library/dn487457.aspx'}],
 'id': 'attack-pattern--f4c1826f-a322-41cd-9557-562100848c84',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'credential-access'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'defense-evasion'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'persistence'}],
 'modified': '2025-10-24T17:49:36.944Z',
 'name': 'Modify Authentication Process',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Chris Ross @xorrior'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows',
                       'Linux',
                       'macOS',
                       'Network Devices',
                       'IaaS',
                       'SaaS',
                       'Office Suite',
                       'Identity Provider'],
 'x_mitre_version': '2.6'}