Key credential attribute modification

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Windows Event Collector OR XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags	Active Directory Certificate Services Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Informational

Description

A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.

Attacker's Goals

An attacker may be attempting to add shadow credentials to an account, gaining persistent unauthorized access.

Investigative actions

• Follow further PKINIT authentication activity by the modified identity.* Verify if Windows Hello for Business is enabled, as this is a common benign cause for this activity.* Check if the modified credential maps to an existing device ID in Entra ID.* Examine recent activity from the user account, including logon patterns and privilege changes.

Variations

Possible shadow credentials addition

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Medium

Description

A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.

Attacker's Goals

An attacker may be attempting to add shadow credentials to an account, gaining persistent unauthorized access.

Investigative actions

• Follow further PKINIT authentication activity by the modified identity.* Verify if Windows Hello for Business is enabled, as this is a common benign cause for this activity.* Check if the modified credential maps to an existing device ID in Entra ID.* Examine recent activity from the user account, including logon patterns and privilege changes.

Key credential attribute addition

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Low

Description

A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.

Attacker's Goals

An attacker may be attempting to add shadow credentials to an account, gaining persistent unauthorized access.

Investigative actions

• Follow further PKINIT authentication activity by the modified identity.* Verify if Windows Hello for Business is enabled, as this is a common benign cause for this activity.* Check if the modified credential maps to an existing device ID in Entra ID.* Examine recent activity from the user account, including logon patterns and privilege changes.