What MITRE ATT&CK T1556.009: Conditional Access Policies (Enterprise Tactic TA0006 - Credential Access / TA0005 - Defense Evasion / TA0003 - Persistence) requires
MITRE ATT&CK T1556.009 (Conditional Access Policies) is an Enterprise Credential Access and Defense Evasion and Persistence sub-technique of T1556 (Modify Authentication Process). Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource. For example, in Entra ID, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication. Affected platforms: IaaS, Identity Provider. MITRE-documented mitigations include M1018 User Account Management. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, AC-07, AC-16, AC-20, CA-07.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1556/009/
SHA-256 integrity: d362078f6b02d0e09dc48d523b2ecd25feb253a28d1af7fdcd3f309c6b7287c2
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1556.009: Conditional Access Policies (https://attack.mitre.org/techniques/T1556/009/)
- MITRE ATT&CK Tactic TA0006: Credential Access (https://attack.mitre.org/tactics/TA0006/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access