AML.T0091

MITRE ATLAS / Use Alternate Authentication Material

Adversaries use authentication material other than a password, such as password hashes, Kerberos tickets, or application access tokens, to move laterally and bypass normal access controls.

Think of it likeUsing a pass that was already stamped, so you never have to show identification at the next desk.

In plain English

Tokens and tickets are accepted in place of a login. Reusing one moves the attacker to the next system without ever triggering a password prompt or a multi-factor check.