value: The malware employed a technique that altered the NTLM authentication program and implanted a skeleton key to allow adversaries to log-in without a valid credential.
  
name: Modify Authentication Process: Domain Controller Authentication