NIST-IA-2 Identification and Authentication (Organizational Users)

Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity. Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks. The use of encrypted virtual private networks for network connections between organization-controlled endpoints and non-organization-controlled endpoints may be treated as internal networks with respect to protecting the confidentiality and integrity of information traversing the network. Identification and authentication requirements for non-organizational users are described in [IA-8](#ia-8).

• T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1021.007 Cloud Services • T1021.008 Direct Cloud VM Connections • T1036.007 Double File Extension • T1036.010 Masquerade Account Name • T1040 Network Sniffing • T1047 Windows Management Instrumentation • T1053 Scheduled Task/Job • T1053.002 At • T1053.003 Cron • T1053.005 Scheduled Task • T1053.006 Systemd Timers • T1053.007 Container Orchestration Job • T1055 Process Injection • T1055.008 Ptrace System Calls • T1056.003 Web Portal Capture • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.008 Network Device CLI • T1059.009 Cloud API • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.002 Domain Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1087.004 Cloud Account • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.002 Additional Email Delegate Permissions • T1098.003 Additional Cloud Roles • T1098.004 SSH Authorized Keys • T1098.007 Additional Local or Domain Groups • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1111 Multi-Factor Authentication Interception • T1114 Email Collection • T1114.002 Remote Email Collection • T1133 External Remote Services • T1134 Access Token Manipulation • T1134.001 Token Impersonation/Theft • T1134.002 Create Process with Token • T1134.003 Make and Impersonate Token • T1136 Create Account • T1136.001 Local Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1185 Browser Session Hijacking • T1190 Exploit Public-Facing Application • T1197 BITS Jobs • T1210 Exploitation of Remote Services • T1212 Exploitation for Credential Access • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.003 Code Repositories • T1213.004 Customer Relationship Management Software • T1213.005 Messaging Applications • T1218 System Binary Proxy Execution • T1218.007 Msiexec • T1222 File and Directory Permissions Modification • T1222.001 Windows File and Directory Permissions Modification • T1222.002 Linux and Mac File and Directory Permissions Modification • T1484 Domain or Tenant Policy Modification • T1489 Service Stop • T1495 Firmware Corruption • T1505 Server Software Component • T1505.002 Transport Agent • T1505.004 IIS Components • T1525 Implant Internal Image • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1538 Cloud Service Dashboard • T1539 Steal Web Session Cookie • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.005 TFTP Boot • T1543 Create or Modify System Process • T1543.001 Launch Agent • T1543.002 Systemd Service • T1543.003 Windows Service • T1543.004 Launch Daemon • T1543.005 Container Service • T1546.003 Windows Management Instrumentation Event Subscription • T1547.004 Winlogon Helper DLL • T1547.006 Kernel Modules and Extensions • T1547.009 Shortcut Modification • T1547.012 Print Processors • T1547.013 XDG Autostart Entries • T1548 Abuse Elevation Control Mechanism • T1548.002 Bypass User Account Control • T1548.003 Sudo and Sudo Caching • T1550 Use Alternate Authentication Material • T1550.001 Application Access Token • T1550.002 Pass the Hash • T1550.003 Pass the Ticket • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.002 Credentials in Registry • T1552.004 Private Keys • T1552.006 Group Policy Preferences • T1552.007 Container API • T1555.005 Password Managers • T1556 Modify Authentication Process • T1556.001 Domain Controller Authentication • T1556.003 Pluggable Authentication Modules • T1556.004 Network Device Authentication • T1556.006 Multi-Factor Authentication • T1556.007 Hybrid Identity • T1556.009 Conditional Access Policies • T1558 Steal or Forge Kerberos Tickets • T1558.001 Golden Ticket • T1558.002 Silver Ticket • T1558.003 Kerberoasting • T1558.004 AS-REP Roasting • T1558.005 Ccache Files • T1559 Inter-Process Communication • T1559.001 Component Object Model • T1562 Impair Defenses • T1562.001 Disable or Modify Tools • T1562.002 Disable Windows Event Logging • T1562.004 Disable or Modify System Firewall • T1562.006 Indicator Blocking • T1562.007 Disable or Modify Cloud Firewall • T1562.008 Disable or Modify Cloud Logs • T1562.009 Safe Mode Boot • T1563 Remote Service Session Hijacking • T1563.001 SSH Hijacking • T1563.002 RDP Hijacking • T1569 System Services • T1569.001 Launchctl … and 23 more