MITRE ATLAStechnique
AML.T0091 Use Alternate Authentication Material
- Tactics
- Lateral Movement
- Created
- 2025-10-27
Description
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
AI services commonly use alternate authentication material as a primary means for users to make queries, making them vulnerable to this technique.
Related
Tactic · MITRE ATLAS (1)
- AML.TA0015 Lateral Movement tactic
Att&ck equivalent · MITRE ATT&CK (1)
- T1550 Use Alternate Authentication Material technique
Referenced by MITRE ATLAS · subtechnique of (1)
- AML.T0091.000 Application Access Token sub-technique