Use Alternate Authentication Material
Technique · ATTACK:enterprise:T1550
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1550",
"title": "Use Alternate Authentication Material",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1550",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--51a14c76-dd3b-440b-9c20-2bf91d25a814",
"external_id": "T1550",
"domain": "enterprise",
"created": "2020-01-30T16:18:36.873Z",
"modified": "2026-05-12T15:12:00.633Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"lateral-movement"
],
"source_references": [
{
"source_name": "NIST Authentication",
"url": "https://csrc.nist.gov/glossary/term/authentication"
},
{
"source_name": "NIST MFA",
"url": "https://csrc.nist.gov/glossary/term/multi_factor_authentication"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:T1550.004 → subtechnique-of → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02fee6ab-f7a1-4168-919f-63c4f0b3349c
ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a8a7397-8977-4554-abbf-5168074cd4cc
Microsoft 365 Defender Solorigate · Secureworks IRON RITUAL ProfileATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4aa81ed2-b2d8-490f-a0b4-e0d2e5772acc
ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5aecf348-f5d8-4e96-93bb-d9517913167f
ATTACK:enterprise:T1550.001 → subtechnique-of → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--682eac15-9d0a-4dc6-8a0a-29f4e15e0696
ATTACK:enterprise:T1550.003 → subtechnique-of → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a387a6a-2359-4ea6-ab73-9428e188d408
ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ee04a90-7158-43a6-8133-9b498f1fef2c
MSTIC FoggyWeb September 2021ATTACK:enterprise:M1036 → mitigates → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71f51186-1805-4108-bde1-5f999de8603d
ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72904b3d-5b24-4698-8094-8919f3bda494
ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--868a59bb-27ed-4c54-8de0-54fcc22e911e
ATTACK:enterprise:M1013 → mitigates → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a53e9789-54e4-486c-8856-3281c9ef1a23
Microsoft Token Protection 2023 · Okta DPoP 2023ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bdf60e66-264d-45ec-bb67-b74fa04fe28e
ATTACK:enterprise:T1550.002 → subtechnique-of → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c54ccdc7-ed15-45c7-bfc9-f6e6e2b0d7f3