Esc
Forced Authentication - T1187

(ATT&CK® Technique)
Definition

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1187["Forced Authentication"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1187 OffensiveTechniqueNode;
        class AuthenticationLog ArtifactNode; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog";
        click T1187 href "/offensive-technique/attack/T1187/"; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog"; T1187["Forced Authentication"] --> |may-modify| WindowsShortcutFile["Windows Shortcut File"]; class T1187 OffensiveTechniqueNode;
        class WindowsShortcutFile ArtifactNode; click WindowsShortcutFile href "/dao/artifact/d3f:WindowsShortcutFile";
        click T1187 href "/offensive-technique/attack/T1187/"; click WindowsShortcutFile href "/dao/artifact/d3f:WindowsShortcutFile";                          ContentModification["Content Modification"] -->
          | modifies | WindowsShortcutFile["Windows Shortcut File"];

          ContentModification["Content Modification"] -.->
            | may-isolate | T1187["Forced Authentication"] ;
          class ContentModification DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click ContentModification href "/technique/d3f:ContentModification"; ContentQuarantine["Content Quarantine"] -->
          | quarantines | WindowsShortcutFile["Windows Shortcut File"];

          ContentQuarantine["Content Quarantine"] -.->
            | may-isolate | T1187["Forced Authentication"] ;
          class ContentQuarantine DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click ContentQuarantine href "/technique/d3f:ContentQuarantine";                           FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | WindowsShortcutFile["Windows Shortcut File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1187["Forced Authentication"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring"; FileEncryption["File Encryption"] -->
          | encrypts | WindowsShortcutFile["Windows Shortcut File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1187["Forced Authentication"] ;
          class FileEncryption DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption";                           DecoyFile["Decoy File"] -->
          | spoofs | WindowsShortcutFile["Windows Shortcut File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1187["Forced Authentication"] ;
          class DecoyFile DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile";              FileEviction["File Eviction"] -->
          | deletes | WindowsShortcutFile["Windows Shortcut File"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1187["Forced Authentication"] ;
          class FileEviction DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction"; RestoreFile["Restore File"] -->
          | restores | WindowsShortcutFile["Windows Shortcut File"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1187["Forced Authentication"] ;
          class RestoreFile DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile";               LocalFilePermissions["Local File Permissions"] -->
          | restricts | WindowsShortcutFile["Windows Shortcut File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1187["Forced Authentication"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions";                        RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | WindowsShortcutFile["Windows Shortcut File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1187["Forced Authentication"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation";              ContentFiltering["Content Filtering"] -->
          | filters | WindowsShortcutFile["Windows Shortcut File"];

          ContentFiltering["Content Filtering"] -.->
            | may-isolate | T1187["Forced Authentication"] ;
          class ContentFiltering DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click ContentFiltering href "/technique/d3f:ContentFiltering";              FileAnalysis["File Analysis"] -->
          | analyzes | WindowsShortcutFile["Windows Shortcut File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1187["Forced Authentication"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class WindowsShortcutFile ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis";
json