T1550Lateral Movement
Use Alternate Authentication Material
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports1
Detections
5 Sigma rules tagged T1550Use Alternate Authentication MaterialT15505 general rules
- AWS Suspicious SAML Activitymediumtest
- AWS STS AssumeRole Misuselowtest
- AWS STS GetSessionToken Misuselowtest
- Outgoing Logon with New Credentialslowtest
- User with Privileges Logonlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Use Alternate Authentication Material
2 CVEs, by priority. Each link shows its badge.- CVE-2026-5430WSO2 Multiple Products Path Traversal VulnerabilityWSO2 · Multiple ProductsKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1078Valid Accounts+1 moreAI mapping from the description · primary impact22.4%Top 2.3%79.5priority
- CVE-2025-54236Adobe Commerce and Magento Improper Input Validation VulnerabilityAdobe · Commerce and MagentoKEVPublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1550Use Alternate Authentication MaterialAI mapping from the description · primary impact95.4%Top 0.13%69.3priority
Linked through a sub-technique
5 more- CVE-2023-23397Microsoft Office Outlook Privilege Escalation Vulnerability97.2%Top 0.11%79.8priority
- CVE-2024-13159Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 more>99.9%Top 0.01%68.2priority
- CVE-2024-13160Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 more91.0%Top 0.19%68.2priority
- CVE-2024-13161Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 more89.8%Top 0.21%68.2priority
- CVE-2018-15801Authorization Bypass During JWT Issuer Validation with spring-security0.7%Top 49%12.6priority