aol.pm

Modify Authentication Process

Technique · ATTACK:enterprise:T1556

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1556",
  "title": "Modify Authentication Process",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1556",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f4c1826f-a322-41cd-9557-562100848c84",
  "external_id": "T1556",
  "domain": "enterprise",
  "created": "2020-02-11T19:01:56.887Z",
  "modified": "2026-05-12T15:12:00.724Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment",
    "persistence",
    "credential-access"
  ],
  "source_references": [

  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:T1556.004 → subtechnique-of → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09bb741d-4f8b-4ae5-95f7-38d85e4d825a

ATTACK:enterprise:T1556.001 → subtechnique-of → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--193fda36-9c40-47dd-b6e5-4fed75d7e844

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fea6d3f-b097-4e4e-b089-5abd6e2659e7

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25c3894b-69ee-49ba-8665-17e2dad68538

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2686dfb7-60ab-424c-add2-2f164a98cfa4

ATTACK:enterprise:T1556.009 → subtechnique-of → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38ae2a97-1756-4452-b542-33d00b891742

ATTACK:enterprise:T1556.008 → subtechnique-of → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d8ab290-c3fb-4a0e-aaf6-d783fccfdbb7

ATTACK:enterprise:T1556.002 → subtechnique-of → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fbe092c-7029-4c31-ac96-9fd2fb13fa2c

ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b5a618e-3a67-4223-a158-af4ce7e0c7d9

ESET Ebury Feb 2014

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a1d90c0-f103-4e7f-b462-73749407dceb

store_pwd_rev_enc

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70f37bdd-dd94-46de-b41b-dd5e04997d3b

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0487 → uses → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8544d4c3-e2e5-44c6-b57d-a169143f49eb

ESET ForSSHe December 2018

ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3659b6e-9588-4b4c-aca0-32282f96167f

Cisco ArcaneDoor 2024

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6aad172-c44b-4d21-9bf3-bb9c2dce2f67

ATTACK:enterprise:T1556.006 → subtechnique-of → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a86e40b2-0ee0-4f70-b32f-80b1bcde9948

ATTACK:enterprise:T1556.007 → subtechnique-of → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad87ebba-c4fc-458a-8ccd-c1cbd16ae14d

ATTACK:enterprise:S9013 → uses → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c15efd63-269b-41c5-a664-cea3dff17c5f

Google UNC5221 Ivanti January 2025 · Picus Security UNC5221 Ivanti May 2025

ATTACK:enterprise:T1556.005 → subtechnique-of → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c973e69a-f07c-470b-a04a-82cd91216c26

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3851a98-39b3-4105-ba93-c0cd91eb01eb

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dafa1584-bdd9-4c46-be07-2d002a529948

MagicWeb · TechNet Credential Theft · TechNet Least Privilege · Microsoft Securing Privileged Access

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df6b68c8-17b5-45b9-8ad1-908c89074531

Mandiant FIN13 Aug 2022

ATTACK:enterprise:T1556.003 → subtechnique-of → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e12a3e0d-4ed1-467b-a2f1-ead1e58b8cae

ATTACK:enterprise:M1025 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef18d02f-bc68-48d8-8076-10e171fde390

Microsoft LSA

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f06c48f0-88de-4850-90dd-9ff4979dde95

MagicWeb · Mandiant Azure AD Backdoors

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc8ef14d-1a07-4f96-85c3-b62ba6bcffc1

EnableMPRNotifications

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.