T1556.005 — Reversible Encryption

Tactics: Defense Impairment, Persistence, Credential Access · Platforms: Windows

An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled…

Sub-technique of Modify Authentication Process (T1556).

Sigma detection rules (1)

T1556.005 Modify Authentication Process: Reversible Encryption

title: "T1556.005 Modify Authentication Process: Reversible Encryption"
id: f1e2bbc9-3116-4060-9a80-74a0a300a4e5
description: 'Detects Security Event 4738 where UserAccountControl flags indicate AllowReversiblePasswordEncryption was enabled. (Data Component: User Account Management; baseline tier: windows-eventid.) Tune using: MonitoredOUs, TimeWindow, SuspiciousCmdletList.'
references:
  - https://attack.mitre.org/techniques/T1556/005
author: Shahrukh Khan
date: 2026-04-12
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.005

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 4738
    UserAccountControl|contains: 'Encrypted Text Password Allowed'
  condition: selection

falsepositives:
  - Legacy applications/protocols requiring reversible password encryption.

level: medium

Related sub-techniques

Explore