t1556-001-domain-controller-authentication

name	T1556.001_domain-controller-authentication
description	Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.
category	authentication
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1556.001","credential-access","defense-evasion","persistence","windows","sub-technique"]
technique_id	T1556.001
tactic	credential-access
all_tactics	["credential-access","defense-evasion","persistence"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1556/001
tech_stack	["windows"]
cwe_ids	["CWE-522"]
chains_with	["T1556","T1556.002","T1556.003","T1556.004","T1556.005","T1556.006","T1556.007","T1556.008","T1556.009"]
prerequisites	["T1556"]
severity_boost	{"T1556":"Chain with T1556 for deeper attack path","T1556.002":"Chain with T1556.002 for deeper attack path","T1556.003":"Chain with T1556.003 for deeper attack path"}

T1556.001 Domain Controller Authentication

Sub-technique of: T1556

High-Level Description

Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.

Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: Skeleton Key). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.

Kill Chain Phase

• Credential Access (TA0006)
• Defense Evasion (TA0005)
• Persistence (TA0003)

Platforms: Windows

What to Check

• Identify if Domain Controller Authentication technique is applicable to target environment
• Check Windows systems for indicators of Domain Controller Authentication
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Skeleton Key via Mimikatz

Injects a Skeleton Key into LSASS on a domain controller using Mimikatz. Once injected, any domain user account can be authenticated using the password 'mimikatz' until the domain controller is rebooted.

This test must be run on an isolated domain controller and must not be performed on a production DC. Cleanup forces a reboot of the domain controller to evict the skeleton key from LSASS memory.

Supported Platforms: windows Elevation Required: Yes

& "#{mimikatz_path}" "privilege::debug" "misc::skeleton" "exit"

Dependencies: