Skip to main content
Cyber Defense TacticsCyber Defense Tactics
HomeLearnResourcesBlogCommunity
Cyber Defense TacticsCyber Defense Tactics

Learn defensive security, leverage AI for cyber defense, and join a community of security professionals.

Learning

  • Blog
  • Resources
  • Newsletter

Community

  • Community
  • YouTube
  • About

Legal

  • Privacy Policy
  • Terms of Service

© 2026 Cyber Defense Tactics. All rights reserved.

A Carbene.AI Project

Back to ATT&CK Hub
T1550

Use Alternate Authentication Material

Lateral Movement

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens to move laterally.

View on MITRE ATT&CK

Defense Strategies

  • Implement Credential Guard
  • Limit credential caching
  • Monitor Kerberos ticket requests
  • Use Protected Users group

Detection Methods

  • Detect pass-the-hash activity
  • Monitor for anomalous Kerberos requests
  • Track NTLM authentication patterns

Related Techniques in Lateral Movement

T1021

Remote Services

Ready to explore more techniques and join the community?