Modify Authentication Process

What is Modify Authentication Process?

“Modify Authentication Process is documented as technique T1556 in MITRE ATT&CK® v19.1 under the Credential Access tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Modify Authentication Process activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for suspicious modifications to Active Directory authentication processes on domain controllers, including unusual processes accessing LSASS memory that may indicate skeleton key malware implantation.

2. 2

   Alert on PAM configuration file modifications and changes to PAM-related shared library files on Linux systems, as attackers modify these to capture all authentication credentials passing through the PAM stack.

3. 3

   Detect addition of new SAML identity providers, OAuth applications, or other SSO integrations in cloud platforms and identity management systems that were not provisioned through authorized change management processes.

4. 4

   Monitor domain controller event logs for evidence of domain replication metadata changes that do not correspond to authorized Active Directory schema or configuration changes, which may indicate authentication subsystem patching.

5. 5

   Implement file integrity monitoring on authentication-related binaries and libraries including winlogon.exe, lsasrv.dll, and PAM module libraries, alerting on any unauthorized modifications to these security-critical components.

Example Alerts

These realistic alert examples show what Modify Authentication Process looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Modify Authentication Process?

Detection centers on SIEM, XDR telemetry for the credential access phase of the attack. Monitor for suspicious modifications to Active Directory authentication processes on domain controllers, including unusual processes accessing LSASS memory that may indicate skeleton key malware implantation. Alert on PAM configuration file modifications and changes to PAM-related shared library files on Linux systems, as attackers modify these to capture all authentication credentials passing through the PAM stack.

What does a Modify Authentication Process alert look like?

A representative XDR detection is "Skeleton Key Malware Detected in Domain Controller Memory" (critical severity): Memory analysis of domain controller DC-PRIMARY detected patching of NTLM authentication in the LSASS process memory consistent with the Mimikatz skeleton key module. This implant allows any account to authenticate with a single master password while also accepting the original password. Detection occurred through behavioral monitoring of processes accessing LSASS memory; the skeleton key provides persistent domain-wide authentication bypass requiring immediate DC remediation.

Which tools detect Modify Authentication Process, and how can I practice?

Modify Authentication Process (T1556) is best surfaced with SIEM, XDR telemetry, which exposes the credential access signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.