Modify Authentication Process, Technique T1556 - Enterprise | MITRE ATT&CK®

Modify Authentication Process, Technique T1556 - Enterprise | MITRE ATT&CK®
Currently viewing
ATT&CK v17.1
which was live between April 22, 2025 and October 27, 2025.
Learn more about the versioning system
or
see the live site
Techniques
Enterprise
Modify Authentication Process
Modify Authentication Process
Sub-techniques (9)
ID
Name
T1556.001
Domain Controller Authentication
T1556.002
Password Filter DLL
T1556.003
Pluggable Authentication Modules
T1556.004
Network Device Authentication
T1556.005
Reversible Encryption
T1556.006
Multi-Factor Authentication
T1556.007
Hybrid Identity
T1556.008
Network Provider DLL
T1556.009
Conditional Access Policies
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using
Valid Accounts
Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
ID:
T1556
Sub-techniques:
T1556.001
T1556.002
T1556.003
T1556.004
T1556.005
T1556.006
T1556.007
T1556.008
T1556.009
Tactics:
Credential Access
Defense Evasion
Persistence
Platforms:
IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS
Contributors:
Chris Ross @xorrior
Version:
2.6
Created:
11 February 2020
Last Modified:
15 April 2025
Version Permalink
Live Version
Procedure Examples
ID
Name
Description
C0046
ArcaneDoor
ArcaneDoor
included modification of the AAA process to bypass authentication mechanisms.
[1]
S0377
Ebury
Ebury
can intercept private keys using a trojanized
ssh-add
function.
[2]
G1016
FIN13
FIN13
has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications.
[3]
S0487
Kessel
Kessel
has trojanized the
ssh_login
and
user-auth_pubkey
functions to steal plaintext credentials.
[4]
S0692
SILENTTRINITY
SILENTTRINITY
can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.
[5]
Mitigations
ID
Mitigation
Description
M1047
Audit
Review authentication logs to ensure that mechanisms such as enforcement of MFA are functioning as intended.
Periodically review the hybrid identity solution in use for any discrepancies. For example, review all Pass Through Authentication (PTA) agents in the Azure Management Portal to identify any unwanted or unapproved ones.
[6]
If ADFS is in use, review DLLs and executable files in the AD FS and Global Assembly Cache directories to ensure that they are signed by Microsoft. Note that in some cases binaries may be catalog-signed, which may cause the file to appear unsigned when viewing file properties.
[7]
Periodically review for new and unknown network provider DLLs within the Registry (
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\\NetworkProvider\ProviderPath
). Ensure only valid network provider DLLs are registered. The name of these can be found in the Registry key at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
, and have corresponding service subkey pointing to a DLL at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentC ontrolSet\Services\\NetworkProvider
M1032
Multi-factor Authentication
Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.
M1028
Operating System Configuration
Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (
C:\Windows\System32\
by default) of a domain controller and/or local computer with a corresponding entry in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages
Starting in Windows 11 22H2, the
EnableMPRNotifications
policy can be disabled through Group Policy or through a configuration service provider to prevent Winlogon from sending credentials to network providers.
[8]
M1027
Password Policies
Ensure that
AllowReversiblePasswordEncryption
property is set to disabled unless there are application requirements.
[9]
M1026
Privileged Account Management
Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account.
[10]
[11]
These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
[12]
Limit access to the root account and prevent users from modifying protected components through proper privilege separation (ex SELinux, grsecurity, AppArmor, etc.) and limiting Privilege Escalation opportunities.
Limit on-premises accounts with access to the hybrid identity solution in place. For example, limit Azure AD Global Administrator accounts to only those required, and ensure that these are dedicated cloud-only accounts rather than hybrid ones.
[7]
M1025
Privileged Process Integrity
Enabled features, such as Protected Process Light (PPL), for LSA.
[13]
M1022
Restrict File and Directory Permissions
Restrict write access to the
/Library/Security/SecurityAgentPlugins
directory.
M1024
Restrict Registry Permissions
Restrict Registry permissions to disallow the modification of sensitive Registry keys such as
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
M1018
User Account Management
Ensure that proper policies are implemented to dictate the the secure enrollment and deactivation of authentication mechanisms, such as MFA, for user accounts.
Detection
ID
Data Source
Data Component
Detects
DS0026
Active Directory
Active Directory Object Modification
Monitor for changes made to AD security settings related to MFA logon requirements, such as changes to Azure AD Conditional Access Policies or the registration of new MFA applications.
Monitor for changes made to security settings related to Azure AD Conditional Access Policies. These can be found in the Azure AD audit log under the operation name
Update Conditional Access policy.
[14]
Analytic 1 - Changes to AD security settings outside of normal maintenance windows.
index=security sourcetype IN ("WinEventLog:Security", "azure:activity", "gsuite:reports:activity", "aws:cloudtrail", "linux_audit", "macos_secure", "network_logs")(EventCode IN (4670, 5136, 5137, 5139, 5141) OR eventName IN ("UpdateUser", "UpdateGroup", "UpdatePolicy", "UpdateRole", "PutRolePolicy", "AttachUserPolicy", "AttachGroupPolicy", "AttachRolePolicy") OR "protoPayload.methodName" IN ("directory.users.update", "admin.directory.group.update", "admin.directory.roleAssignments.update"))
DS0015
Application Log
Application Log Content
Enable security auditing to collect logs from hybrid identity solutions. For example, monitor sign-ins to the Entra ID Application Proxy Connector, which are typically generated only when a new Pass Through Authentication (PTA) Agent is added.
[6]
If AD FS is in use, review the logs for event ID 501, which specifies all EKU attributes on a claim, and raise alerts on any values that are not configured in your environment.
[7]
Analytic 1 - Unexpected sign-ins or new PTA Agent additions.
index=third_party_logs sourcetype IN ("azure:activity", "gsuite:reports:activity", "aws:cloudtrail", "office365:management", "saas_audit")(eventName IN ("AddServicePrincipal", "AddUser", "UpdateUser", "AddGroup", "UpdateGroup", "AddPolicy", "UpdatePolicy", "AddRole", "UpdateRole", "PutRolePolicy", "AttachUserPolicy", "AttachGroupPolicy", "AttachRolePolicy") OR eventCategory IN ("Sign-ins", "Security", "AuditLogs") OR EventID IN (501, 4662) OR "protoPayload.methodName" IN ("directory.users.update", "admin.directory.group.update", "admin.directory.roleAssignments.update"))
DS0025
Cloud Service
Cloud Service Modification
Monitor for changes made to conditional access policies used by SaaS identity providers and internal IaaS identity and access management systems.
Analytic 1 - Changes to access policies without corresponding change requests.
index=cloud_logs sourcetype IN ("azure:activity", "gsuite:reports:activity", "aws:cloudtrail", "office365:management", "saas_audit")(eventName IN ("UpdateServicePrincipal", "UpdateUser", "UpdateGroup", "UpdatePolicy", "UpdateRole", "PutRolePolicy", "AttachUserPolicy", "AttachGroupPolicy", "AttachRolePolicy", "ModifyAuthenticationMethod") OR protoPayload.methodName IN ("directory.users.update", "admin.directory.group.update", "admin.directory.roleAssignments.update", "Set-AzureADApplicationProxyConnector", "Update-PassThroughAuthentication") OR (eventName="Sign-in" AND targetResourceType="applicationProxyConnector"))
DS0022
File
File Creation
Monitor for suspicious additions to the
/Library/Security/SecurityAgentPlugins
directory.
[15]
Monitor for newly created files that may be used to register malicious network provider dynamic link libraries (DLLs).
Analytic 1 - Unauthorized file creation in critical directories.
index=security sourcetype IN ("WinEventLog:Security", "wineventlog:sysmon", "linux_audit", "macos_secure")(EventCode=4663 OR EventCode=11 OR EventCode=13 OR (sourcetype="linux_audit" AND (syscall="creat" OR syscall="open" OR syscall="openat")) OR (sourcetype="macos_secure" AND action="file_write"))| eval TargetFile=coalesce(ObjectName, FileName, target_file)| search TargetFile IN ( "C:\Windows\System32\config\SAM", "C:\Windows\System32\config\system", "C:\Windows\System32\config\security", "C:\Windows\System32\lsass.exe", "/etc/passwd", "/etc/shadow", "/etc/pam.d/", "/Library/Preferences/com.apple.loginwindow.plist")
File Modification
Monitor for suspicious modification of files associated with authentication processes, such as configuration files and module paths (e.g.
/etc/pam.d/
). Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files. Also monitor for access to certificates and cryptographic keys material.
Analytic 1 - Unauthorized modifications to authentication-related files.
index=security sourcetype IN ("WinEventLog:Security", "WinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_audit", "macos_secure")(EventCode=4663 OR EventCode=11 OR EventCode=13 OR (sourcetype="linux_audit" AND (syscall IN ("creat", "open", "openat", "write", "chmod", "chown", "unlink"))) OR (sourcetype="macos_secure" AND action="file_write"))| eval TargetFile=coalesce(ObjectName, FileName, target_file)| search TargetFile IN ( "C:\Windows\System32\config\SAM", "C:\Windows\System32\config\system", "C:\Windows\System32\config\security", "C:\Windows\System32\lsass.exe", "C:\Windows\System32\Drivers\etc\hosts", "/etc/passwd", "/etc/shadow", "/etc/pam.d/
", "/etc/security/
", "/etc/sshd_config", "/etc/ssh/sshd_config", "/Library/Preferences/com.apple.loginwindow.plist", "/Library/Security/authorization", "/etc/krb5.conf", "/etc/krb5.keytab", "/etc/pam.conf", "/etc/security/access.conf", "/etc/security/limits.conf", "/etc/security/namespace.conf", "/etc/security/sepermit.conf", "/etc/security/time.conf")| eval User=coalesce(Account_Name, user, uid, user_name)| eval Platform=case( sourcetype=="WinEventLog:Security", "Windows", sourcetype=="wineventlog:sysmon", "Windows", sourcetype=="linux_audit", "Linux", sourcetype=="macos_secure", "macOS", true(), "Unknown")
DS0028
Logon Session
Logon Session Creation
Monitor for newly constructed logon behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times (ex: when the user is not present) or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.
[16]
Analytic 1 - Unusual logon patterns and times.
index=security sourcetype IN ("WinEventLog:Security", "linux_secure", "macos_secure")(EventCode=4624 OR EventCode=4625 OR EventCode=4768 OR EventCode=4769 OR EventCode=4776 OR EventCode=4778 OR EventCode=4779 OR EventCode=5379 OR EventCode=22)| eval LogonType=case( EventCode==4624, "Logon", EventCode==4625, "Failed Logon", EventCode IN (4768, 4769), "Kerberos", EventCode==4776, "NTLM", EventCode==4778, "Session Reconnected", EventCode==4779, "Session Disconnected", EventCode==5379, "Login Attempt", EventCode==22, "Interactive Logon", true(), "Other")| eval User=coalesce(user, UserName, Account_Name, user_name)| eval System=coalesce(ComputerName, host)| eval Platform=case( sourcetype=="WinEventLog:Security", "Windows", sourcetype=="linux_secure", "Linux", sourcetype=="macos_secure", "macOS", true(), "Unknown")| where (date_wday!="saturday" AND date_wday!="sunday") AND (date_hour<9 OR date_hour>17)| bin _time span=1m| stats earliest(_time) as first_time, latest(_time) as last_time, count by User, System, LogonType, Platform| eval duration=last_time-first_time| where (LogonType="Logon" AND duration<60 AND count > 1) OR (LogonType="Failed Logon" AND count > 5)| eval isOddTime=if(date_hour<9 OR date_hour>17, "Yes", "No")| eval isMultipleSystems=if(count>1, "Yes", "No")| table first_time, last_time, duration, User, System, LogonType, Platform, count, isOddTime, isMultipleSystems| sort -count
DS0011
Module
Module Load
Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Password filters will also show up as an autorun and loaded DLL in lsass.exe.
[17]
If AD FS is in use, monitor the AD FS server for the creation of DLLs as well as the loading of unrecognized or unsigned DLLs into the
Microsoft.IdentityServer.Servicehost
application.
[7]
Analytic 1 - Unauthorized DLL loads in critical systems.
index=security sourcetype IN ("WinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_secure", "macos_secure")(EventCode=7 OR EventCode=10 OR sourcetype="linux_secure" OR sourcetype="macos_secure")| eval ImageLoaded=coalesce(Image, file_path, target_file)| eval Process=coalesce(ProcessGuid, pid, process_id)| eval User=coalesce(User, user, user_name)| eval Platform=case( sourcetype=="WinEventLog:Microsoft-Windows-Sysmon/Operational", "Windows", sourcetype=="linux_secure", "Linux", sourcetype=="macos_secure", "macOS", true(), "Unknown")| search ImageLoaded IN ( "
\lsass.exe", "
\services.exe", "
\winlogon.exe", "/usr/libexec/
", "/usr/bin/
", "/etc/pam.d/
", "/Library/Preferences/com.apple.loginwindow.plist")| search ImageLoaded IN ("
.dll", "
.so", "
.dylib")| eval isSuspicious=if(match(ImageLoaded, ".
\(?!\")(lsass|services|winlogon).exe\.
\.dll$|/usr/libexec/.
\.so$|/usr/bin/.
\.so$|/etc/pam.d/.
\.so$|/Library/Preferences/com.apple.loginwindow.plist.
\.dylib$"), "Yes", "No")| where isSuspicious="Yes"| bin _time span=1m| stats count by _time, User, ImageLoaded, Process, Platform, host| where count > 1| table _time, User, ImageLoaded, Process, Platform, host, count| sort -count
DS0009
Process
OS API Execution
Monitor for calls to
OpenProcess
that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).
[18]
Monitor for abnormal API calls to
NPLogonNotify()
that may highlight malicious network provider DLLs.
[19]
Analytic 1 - Unauthorized API calls to manipulate lsass.exe or abnormal API calls
index=security sourcetype IN ("Sysmon", "WinEventLog:Security", "Powershell", "linux_audit", "macos_secure")(EventCode=4688 OR EventCode=10 OR EventID=4104)| eval CommandLine=coalesce(CommandLine, process_command_line, message)| eval User=coalesce(User, user, user_name)| eval Platform=case( sourcetype=="WinEventLog:Microsoft-Windows-Sysmon/Operational", "Windows", sourcetype=="linux_audit", "Linux", sourcetype=="macos_secure", "macOS", true(), "Unknown")| search CommandLine IN ("
SetWindowsHookEx
", "
LogonUser
", "
AuthenticateUser
", "
pam_unix
", "
pam_exec
", "
osascript
", "
launchctl
")| eval isSuspicious=if( (Platform="Windows" AND (match(CommandLine, ".
SetWindowsHookEx.
|.
LogonUser.
|.
CredWrite.
"))), (Platform="Linux" AND (match(CommandLine, ".
pam_unix.
|.
pam_exec.
"))), (Platform="macOS" AND (match(CommandLine, ".
osascript.
|.
launchctl.
"))), "Yes", "No")| where isSuspicious="Yes"| stats count by _time, User, CommandLine, Platform, host| where count > 1| table _time, User, CommandLine, Platform, host, count| sort -count
Analytic 2 - Unauthorized API calls to manipulate lsass.exe or abnormal API calls to NPLogonNotify().
index=security_logs source="WinEventLog:Security" | eval suspicious_processes=if((process_name="lsass.exe" AND action="OpenProcess") OR (dll_name IN ("cryptdll.dll", "samsrv.dll") AND (action="modify" OR action="load")) OR (api_call="NPLogonNotify" AND dll_name="unknown")), "true", "false")| search suspicious_processes="true"| stats count by host, process_name, dll_name, api_call, user, action| where count > 1
Process Access
Monitor for unexpected processes interacting with authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
Analytic 1 - Unauthorized process interactions with authentication mechanisms.
( index=your_index source="WinEventLog:Security" EventCode=4688 | where (New_Process_Name IN ("C:\Windows\System32\lsass.exe", "C:\Windows\System32\winlogon.exe"))AND (Parent_Process_Name != "C:\Windows\System32\services.exe")| stats count by New_Process_Name, Parent_Process_Name, Account_Name, ComputerName) OR (index=your_index sourcetype=linux_auditd| where file IN ("/etc/pam.d/", "/etc/passwd", "/etc/shadow")| stats count by file, user, host )
DS0002
User Account
User Account Authentication
Monitor for account authentications in which MFA credentials are not provided by the user account to the authenticating entity.
Analytic 1 - Windows Successful logons without MFA.
index=your_index sourcetype="WinEventLog:Security" EventCode=4624 | eval MFA_used=if(searchmatch("MFA"), "Yes", "No")| where MFA_used="No"| stats count by Account_Name, Logon_Type, IpAddress, ComputerName
Analytic 2 - Linux Successful logons without MFA.
index=your_index sourcetype="linux_secure" OR sourcetype="macos_auth" "Accepted password" | eval MFA_used=if(searchmatch("MFA"), "Yes", "No")| where MFA_used="No"| stats count by user, src_ip, host
User Account Modification
Monitor for the enrollment of devices and user accounts with alternative security settings that do not require MFA credentials for successful logon.
Analytic 1 - Unauthorized modification of user accounts Windows (User Account Modification)
index=your_index sourcetype="WinEventLog:Security" EventCode IN (4720, 4722, 4724, 4738, 4725, 4732, 4733, 4735, 4737) | eval Risk_Level=if(MemberName="Domain Admins" OR MemberName="Administrators", "High", "Low")| stats count by TargetUserName, AccountName, EventCode, Risk_Level, ComputerName| where Risk_Level="High"
Analytic 2 - macOS/Linux (User Account Modification)
index=your_index sourcetype="linux_secure" OR sourcetype="macos_auth" "usermod" OR "passwd" OR "chpasswd" OR "adduser" OR "deluser" OR "vipw" | stats count by user, command, src_ip, host | where command IN ("usermod", "passwd", "chpasswd", "adduser", "deluser", "vipw")
DS0024
Windows Registry
Windows Registry Key Creation
Monitor for the addition of network provider Registry keys (e.g.,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\\NetworkProvider
).
Analytic 1 - Unauthorized addition of network provider Registry keys.
sourcetype=WinEventLog:Security(EventCode=4663 OR EventCode=4657) | eval registry_path=mvindex(split(ObjectName,"\"), 0, mvcount(split(ObjectName,"\"))-1)| search registry_path IN ("HKLM\SYSTEM\CurrentControlSet\Control\Lsa", "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication", "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters")
Windows Registry Key Modification
Monitor for changes to Registry entries for password filters (ex:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages
) and correlate then investigate the DLL files these files reference.
Monitor for changes to Registry entries for network providers (e.g.,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
) and correlate then investigate the DLL files these values reference.
Analytic 1 - Unauthorized modifications to Registry entries for password filters or network providers.
index=wineventlog| eval suspicious_activity=if((EventCode=4657 AND (RegistryKeyPath="HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages" OR RegistryKeyPath="HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order")) OR (EventCode=4663 AND AccessMask="0x2" AND (ObjectName="HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages" OR ObjectName="HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order")), "true", "false")
Analytic 2 - Unauthorized modification of windows Registry keys may modify authentication mechanism
sourcetype=WinEventLog:Security(EventCode=4657 OR EventCode=4663) | eval registry_path=mvindex(split(ObjectName,"\"), 0, mvcount(split(ObjectName,"\"))-1)| search registry_path IN ("HKLM\SYSTEM\CurrentControlSet\Control\Lsa", "HKLM\SYSTEM\CurrentControlSet\Services\WDigest\Parameters", "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL")
References
Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.
M.Léveillé, M.. (2014, February 21). An In-depth Analysis of Linux/Ebury. Retrieved April 19, 2019.
Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.
Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
Mike Burns. (2020, September 30). Detecting Microsoft 365 and Azure Active Directory Backdoors. Retrieved September 28, 2022.
Microsoft Threat Intelligence Center, Microsoft Detection and Response Team, Microsoft 365 Defender Research Team . (2022, August 24). MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone. Retrieved September 28, 2022.
Microsoft. (2023, January 26). Policy CSP - WindowsLogon. Retrieved March 30, 2023.
Microsoft. (2021, October 28). Store passwords using reversible encryption. Retrieved January 3, 2022.
Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016.
Microsoft. (2016, April 16). Implementing Least-Privilege Administrative Models. Retrieved June 3, 2016.
Plett, C., Poggemeyer, L. (12, October 26). Securing Privileged Access Reference Material. Retrieved April 25, 2017.
Microsoft. (2013, July 31). Configuring Additional LSA Protection. Retrieved February 13, 2015.
Microsoft. (2023, October 23). Troubleshooting Conditional Access policy changes. Retrieved January 2, 2024.
Chris Ross. (2018, October 17). Persistent Credential Theft with Authorization Plugins. Retrieved April 22, 2021.
Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016.
Bialek, J. (2013, September 15). Intercepting Password Changes With Function Hooking. Retrieved November 21, 2017.
Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis. Retrieved April 8, 2019.
Microsoft. (2021, October 21). NPLogonNotify function (npapi.h). Retrieved March 30, 2023.