Forced authentication / coercion

A host or user triggered to authenticate to attacker infrastructure

categoryIdentity, authentication and credential attacksdetectability (measured in our lab)Mediumlabdetected in lab

Example: PetitPotam

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1187 · Trigger an authenticated RPC call to a target server with no Sign flag set · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1187 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1187 -TestGuids 81cfdd7f-1f41-4cc5-9845-bb5149438e37 -TimeoutSeconds 120'

ATT&CK T1187 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1187 -Tool atomic -RunId run-2026-10-14-022 -Command 'Invoke-AtomicTest T1187 -TestGuids 81cfdd7f-1f41-4cc5-9845-bb5149438e37 -TimeoutSeconds 120'

ATT&CK T1187 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1187 -Tool atomic -RunId run-2026-10-18-023 -Command 'Invoke-AtomicTest T1187 -TestGuids 81cfdd7f-1f41-4cc5-9845-bb5149438e37 -TimeoutSeconds 120'

+ 1 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-27 · detected in 42s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Forced authentication / NTLM coercion via rpcping (/a connect /u NTLM) -- T1187
Sysmon · EID 1	Powershell.exe spawned a powershell process which executed a base64 encoded command
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
… and 4 more event type(s)

Detection that fired

✓ Wazuh 100408 (level 10) lab rule — Forced authentication / NTLM coercion via rpcping (/a connect /u NTLM) -- T1187

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~69038 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-18

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell.exe spawned a powershell process which executed a base64 encoded command
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
… and 3 more event type(s)

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~57112 incidental alerts/hour — tune against this.

Classification

18 values: 7 reviewed, 2 lab-measured, 7 imported, 2 derived. What do these mean?

Exploitability

Attack vector	Credential attacksSoftware vulnerabilities
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Platform	Windows
Environment	On-premises
Target asset class	IdentityServer
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	File CreationFile ModificationNetwork Traffic ContentNetwork Traffic Flow

Detection & response

Mitigated by 15

M1027 attack-mitigation
M1037 attack-mitigation
D3-AEM d3fend
D3-CF d3fend
D3-CM d3fend
D3-CQ d3fend
D3-DF d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-OPM d3fend
D3-RF d3fend
D3-RFAM d3fend

Detected by 11

DET0022 attack-detection-strategy
0ed99dda-6a35-11ef-8c99-0242ac120002 sigma
1ce8c8a3-2723-48ed-8246-906ac91061a6 sigma
4096842a-8f9f-4d36-92b4-d0b2a62f9b2a sigma
5588576c-5898-4fac-bcdd-7475a60e8f43 sigma
5a7132c0-86db-4e6b-95c0-f0e9d7f461aa sigma
6a53d871-682d-40b6-83e0-b7c1a6c4e3a5 sigma
7c3a5b1d-9e2f-4a8c-b5d7-1e0f3c6a9b2d sigma
916eb839-895e-47f8-99ee-3008bf377a3e sigma
e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c sigma
100408 wazuh

Tested by 3

485ce873-2e65-4706-9c7e-ae3ab9e14213 atomic
7f06b25c-799e-40f1-89db-999c9cc84317 atomic
81cfdd7f-1f41-4cc5-9845-bb5149438e37 atomic

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-022`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-18-023`	partially-detected	atomic	windows	2026-10-18
`run-2026-10-27-018`	detected	atomic	windows	2026-10-27

run-2026-10-14-022 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1187 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=14 max_level=15 dwell_s=90
run-2026-10-18-023 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1187 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1523 max_level=15 dwell_s=90
run-2026-10-27-018 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1187 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=1841 max_level=15 dwell_s=90

Framework references

Primary source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
attack: T1187 (primary)
cve: CVE-2023-23397

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 331 of Cyber-Attack-Taxonomy.md
ev-0002 (CISA Known Exploited Vulnerabilities Catalog) — CISA KEV lists CVE-2023-23397 as known-exploited (kev=1, ransomware=unknown); added 2023-03-14.
Microsoft Office Outlook Privilege Escalation Vulnerability
ev-0003 (FIRST EPSS scores) — FIRST EPSS for CVE-2023-23397: epss=0.97408 percentile=0.99896 (score date 2026-09-18).
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0005 (NVD CVE API 2.0) — NVD maps CVE-2023-23397 to weakness(es) CWE-20, CWE-294.
ev-0006 (NVD CVE API 2.0) — Example vulnerability CVE-2023-23397: NVD CVSS v3.1 base 9.8 (CRITICAL) [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H]. Not applied as facets: CVSS scores this one vulnerability, not the attack class.
ev-0007 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-022 (partially-detected) for T1187: no alert matched the expected technique
ev-0008 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-023 (partially-detected) for T1187: no alert matched the expected technique
ev-0009 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-018 (detected): Wazuh rule(s) 100408 fired on T1187 within the detonation window
Forced authentication / NTLM coercion via rpcping (/a connect /u NTLM) -- T1187