Key credential attribute modification

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-01-04

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Windows Event Collector OR XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags	Active Directory Certificate Services Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Informational

A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.

An attacker may be attempting to add shadow credentials to an account, gaining persistent unauthorized access.

Follow further PKINIT authentication activity by the modified identity.
Verify if Windows Hello for Business is enabled, as this is a common benign cause for this activity.
Check if the modified credential maps to an existing device ID in Entra ID.
Examine recent activity from the user account, including logon patterns and privilege changes.

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Medium

A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.

An attacker may be attempting to add shadow credentials to an account, gaining persistent unauthorized access.

Follow further PKINIT authentication activity by the modified identity.
Verify if Windows Hello for Business is enabled, as this is a common benign cause for this activity.
Check if the modified credential maps to an existing device ID in Entra ID.
Examine recent activity from the user account, including logon patterns and privilege changes.

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Low

A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.

An attacker may be attempting to add shadow credentials to an account, gaining persistent unauthorized access.

Follow further PKINIT authentication activity by the modified identity.
Verify if Windows Hello for Business is enabled, as this is a common benign cause for this activity.
Check if the modified credential maps to an existing device ID in Entra ID.
Examine recent activity from the user account, including logon patterns and privilege changes.