Forced Authentication

Technique · ATTACK:enterprise:T1187

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1187",
  "title": "Forced Authentication",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1187",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b77cf5f3-6060-475d-bd60-40ccbf28fdc2",
  "external_id": "T1187",
  "domain": "enterprise",
  "created": "2018-01-16T16:13:52.465Z",
  "modified": "2025-10-24T17:49:16.134Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Rapid7",
      "url": "https://www.rapid7.com/blog/post/2021/08/03/petitpotam-novel-attack-chain-can-fully-compromise-windows-domains-running-ad-cs/"
    },
    {
      "source_name": "Cylance Redirect to SMB",
      "url": "https://www.cylance.com/content/dam/cylance/pdfs/white_papers/RedirectToSMB.pdf"
    },
    {
      "source_name": "GitHub Hashjacking",
      "url": "https://github.com/hob0/hashjacking"
    },
    {
      "source_name": "Microsoft Managing WebDAV Security",
      "url": "https://web.archive.org/web/20100210125749/https://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/4beddb35-0cba-424c-8b9b-a5832ad8e208.mspx"
    },
    {
      "source_name": "Osanda Stealing NetNTLM Hashes",
      "url": "https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/"
    },
    {
      "source_name": "Didier Stevens WebDAV Traffic",
      "url": "https://blog.didierstevens.com/2017/11/13/webdav-traffic-to-malicious-sites/"
    },
    {
      "source_name": "GitHub",
      "url": "https://github.com/topotam/PetitPotam"
    },
    {
      "source_name": "US-CERT APT Energy Oct 2017",
      "url": "https://www.us-cert.gov/ncas/alerts/TA17-293A"
    },
    {
      "source_name": "Wikipedia Server Message Block",
      "url": "https://en.wikipedia.org/wiki/Server_Message_Block"
    }
  ]
}

Explicit source assertions (6)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.