菜单
Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1556-001-domain-controller-authentication命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | T1556.001_domain-controller-authentication |
| description | Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. |
| category | authentication |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1556.001","credential-access","defense-evasion","persistence","windows","sub-technique"] |
| technique_id | T1556.001 |
| tactic | credential-access |
| all_tactics | ["credential-access","defense-evasion","persistence"] |
| platforms | ["Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1556/001 |
| tech_stack | ["windows"] |
| cwe_ids | ["CWE-522"] |
| chains_with | ["T1556","T1556.002","T1556.003","T1556.004","T1556.005","T1556.006","T1556.007","T1556.008","T1556.009"] |
| prerequisites | ["T1556"] |
| severity_boost | {"T1556":"Chain with T1556 for deeper attack path","T1556.002":"Chain with T1556.002 for deeper attack path","T1556.003":"Chain with T1556.003 for deeper attack path"} |
Sub-technique of: T1556
Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.
Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: Skeleton Key). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Injects a Skeleton Key into LSASS on a domain controller using Mimikatz. Once injected, any domain user account can be authenticated using the password 'mimikatz' until the domain controller is rebooted.
This test must be run on an isolated domain controller and must not be performed on a production DC. Cleanup forces a reboot of the domain controller to evict the skeleton key from LSASS memory.
Supported Platforms: windows Elevation Required: Yes
& "#{mimikatz_path}" "privilege::debug" "misc::skeleton" "exit"
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Domain Controller Authentication by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1556.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
Enabled features, such as Protected Process Light (PPL), for LSA.
Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.
Train users to recognize and handle suspicious email attachments. Emphasize the importance of caution when opening attachments from unknown or unexpected sources, even if they appear legitimate. Implement email warning banners to alert users about emails originating from outside the organization or containing attachments, reinforcing awareness and helping users identify potential spearphishing attempts.
| Finding | Severity | Impact |
|---|---|---|
| Domain Controller Authentication technique applicable | High | Credential Access |
| CWE ID | Title |
|---|---|
| CWE-522 | Insufficiently Protected Credentials |