25 briefs · 7 controls
Identity attack techniques
A vulnerability is a bug in one product. A technique is a repeatable way to break identity that does not need one. These briefs cover how identity attacks actually work: what an attacker does, why the control they exploit fails, how to detect the attempt, and how to close it, mapped to MITRE ATT&CK.
Start with the control an attacker targets, or browse every brief below.
Attacks on authentication
Techniques that defeat the login itself: real-time phishing proxies, factor relay, enrolment abuse, and credential guessing. Almost none of them break cryptography.
- Attacker-in-the-middle phishing proxyA reverse proxy sits between the user and the real login page, relays every step of authentication including MFA, and keeps the session cookie the successful login produces.WidespreadHard to detect
- Credential stuffingAttackers replay username and password pairs leaked from one breach against every other login page they can reach, betting on the well-documented habit of password reuse.WidespreadModerate
- Device code phishingThe victim enters a code on Microsoft's own login page and approves a real prompt. The attacker requested that code from a second device and walks away with access and refresh tokens.WidespreadHard to detect
- MFA fatigue and push bombingThe attacker already has a password. They trigger push approval prompts until a tired or confused user taps approve, sometimes with a fake IT message to speed the decision along.WidespreadModerate
- OTP relay via social engineeringThe attacker starts a real login and calls the victim posing as support, asking them to read back the one-time code that just arrived. The code is genuine; the request is not.WidespreadHard to detect
- Password sprayingInstead of guessing many passwords against one account and triggering a lockout, the attacker guesses a few common passwords against many accounts, staying under the threshold for each one.WidespreadModerate
- Primary Refresh Token theftCode already running in a signed-in Windows session can drive the device's own Windows Hello key to obtain a Primary Refresh Token, no PIN prompt, no admin rights, no CVE required.EmergingHard to detect
- Refresh token abuseA refresh token exists to let an app get new access tokens without bothering the user again. Stolen, it lets an attacker do the same thing indefinitely, surviving password resets along the way.WidespreadHard to detect
- Session cookie theftA session cookie is a bearer credential that proves nothing beyond possession. Whoever copies it inherits the logged-in session, skipping the password and the MFA challenge that produced it.WidespreadHard to detect
- OAuth consent phishingThe victim never types a password. They click a legitimate 'Sign in with' button, land on the real identity provider, and approve an attacker-registered application's request for mailbox and file access.WidespreadModerate
- Help desk social engineeringA phone call to IT support, not a login attempt, is the actual attack. The target's strong password and MFA enrollment never come into play, because the attacker gets a human to reset both.WidespreadModerate
- AD CS certificate template abuseA certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.TargetedHard to detect
- Federation trust abuse and SAML forgeryA service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.WidespreadModerate
- Credential manager key extractionA passkey or Windows Hello key is supposed to stay locked to its device. Code running on an already-compromised endpoint can pull the key material out of the process that holds it, or drive it without the fresh check meant to gate its use.EmergingHard to detect
- Infostealer credential harvestingCommodity malware on an endpoint reads whatever the browser and OS have stored in the clear or under a key the same machine already holds, then ships it to a marketplace where the credentials outlive the machine they came from.WidespreadHard to detect
Attacks on sessions and tokens
Techniques that skip the login and go straight for what it produces: stolen cookies, replayed access tokens, and refresh credentials that outlive a password reset.
- Attacker-in-the-middle phishing proxyA reverse proxy sits between the user and the real login page, relays every step of authentication including MFA, and keeps the session cookie the successful login produces.WidespreadHard to detect
- Device code phishingThe victim enters a code on Microsoft's own login page and approves a real prompt. The attacker requested that code from a second device and walks away with access and refresh tokens.WidespreadHard to detect
- Primary Refresh Token theftCode already running in a signed-in Windows session can drive the device's own Windows Hello key to obtain a Primary Refresh Token, no PIN prompt, no admin rights, no CVE required.EmergingHard to detect
- Refresh token abuseA refresh token exists to let an app get new access tokens without bothering the user again. Stolen, it lets an attacker do the same thing indefinitely, surviving password resets along the way.WidespreadHard to detect
- Session cookie theftA session cookie is a bearer credential that proves nothing beyond possession. Whoever copies it inherits the logged-in session, skipping the password and the MFA challenge that produced it.WidespreadHard to detect
- Token replay against an unbound endpointA token that is not bound to the client, session, or challenge that requested it can be lifted once and replayed anywhere the check for binding is missing, no matter how it was strengthened.WidespreadHard to detect
- Cross-tenant token confusionA broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.EmergingHard to detect
- Scope escalation through delegationA chain of services each meant to narrow a token's authority instead widens it, because one hop in the delegation path trusts the scope a caller claims rather than the scope it was actually issued.EmergingHard to detect
- Infostealer credential harvestingCommodity malware on an endpoint reads whatever the browser and OS have stored in the clear or under a key the same machine already holds, then ships it to a marketplace where the credentials outlive the machine they came from.WidespreadHard to detect
Attacks on authorization
Techniques that leave the login alone and attack what an authenticated identity is allowed to do: consent abuse, scope escalation, and delegation chains that quietly widen access.
- Cross-tenant token confusionA broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.EmergingHard to detect
- OAuth consent phishingThe victim never types a password. They click a legitimate 'Sign in with' button, land on the real identity provider, and approve an attacker-registered application's request for mailbox and file access.WidespreadModerate
- Scope escalation through delegationA chain of services each meant to narrow a token's authority instead widens it, because one hop in the delegation path trusts the scope a caller claims rather than the scope it was actually issued.EmergingHard to detect
Attacks on identity lifecycle
Techniques that target joiner, mover, and leaver: help desk resets granted on weak proof, entitlements that accumulate across role changes, and accounts nobody remembered to disable.
- Help desk social engineeringA phone call to IT support, not a login attempt, is the actual attack. The target's strong password and MFA enrollment never come into play, because the attacker gets a human to reset both.WidespreadModerate
- Mover entitlement accumulationAn employee who changes roles keeps every entitlement from every prior role, because provisioning adds access automatically and nothing removes the old access automatically.WidespreadHard to detect
- Orphaned account abuseAn account left active after its owner departed or its purpose ended draws no attention from anyone, because no one owns it, no one expects a login from it, and no one is watching for one.WidespreadHard to detect
Attacks on directory and trust
Techniques that go after the directory itself: Kerberos ticket forgery, certificate services, federation trust, and forest-to-forest compromise. When these fall, everything that trusts them falls with them.
- AD CS certificate template abuseA certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.TargetedHard to detect
- Federation trust abuse and SAML forgeryA service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.WidespreadModerate
- KerberoastingAny authenticated domain user can request a Kerberos service ticket for any service principal, and that ticket is encrypted with the service account's own password hash, offline and unrateable to test.WidespreadModerate
- Kerberos delegation abuseDelegation lets a service act as the user who called it, which is necessary for multi-tier applications and dangerous the moment the service or the delegation scope is not exactly what an administrator intended.TargetedHard to detect
Attacks on credential storage
Techniques that target where secrets rest rather than how they are used: infostealer malware, secrets left in source repositories and CI logs, and key extraction from the vaults meant to protect them.
- KerberoastingAny authenticated domain user can request a Kerberos service ticket for any service principal, and that ticket is encrypted with the service account's own password hash, offline and unrateable to test.WidespreadModerate
- Credential manager key extractionA passkey or Windows Hello key is supposed to stay locked to its device. Code running on an already-compromised endpoint can pull the key material out of the process that holds it, or drive it without the fresh check meant to gate its use.EmergingHard to detect
- Infostealer credential harvestingCommodity malware on an endpoint reads whatever the browser and OS have stored in the clear or under a key the same machine already holds, then ships it to a marketplace where the credentials outlive the machine they came from.WidespreadHard to detect
- Secrets in repositories and CIA credential committed to a config file or pasted into a pipeline variable travels with every clone, fork, and log line, and it keeps working for as long as nobody notices it left the vault.WidespreadModerate
- Static API key abuseA static API key has no expiry, no built-in scope beyond what was granted at creation, and no way to tell whether the caller presenting it is the workflow it was issued to or whoever found it in a public commit.WidespreadHard to detect
Attacks on non-human identity
Techniques that target service accounts, workload identities, and AI agents rather than people: static keys that never rotate, delegation confusion between chained services, and instruction injection against autonomous agents.
- Cross-tenant token confusionA broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.EmergingHard to detect
- Secrets in repositories and CIA credential committed to a config file or pasted into a pipeline variable travels with every clone, fork, and log line, and it keeps working for as long as nobody notices it left the vault.WidespreadModerate
- Agent instruction injectionAn AI coding agent reads whatever text is in front of it, an issue, a title, a comment, and treats it as instruction. If that runner also holds workflow secrets, the text an anonymous account typed becomes something the credential can execute.EmergingHard to detect
- Static API key abuseA static API key has no expiry, no built-in scope beyond what was granted at creation, and no way to tell whether the caller presenting it is the workflow it was issued to or whoever found it in a public commit.WidespreadHard to detect
Technique, control, detection
How to use this catalog
Identity attack techniques: frequently asked questions
- What is an identity attack technique?
- A technique brief describes a repeatable method an attacker uses against authentication, sessions, authorization, or the directory itself, independent of any single product or vulnerability. It covers how the method works, why the underlying control assumption fails, how to detect it, and how to stop it.
- How is this different from a CVE?
- A CVE is a specific flaw in a specific product, tied to a version and a patch. A technique is a pattern of attack that works across many products and does not require a bug at all. An attacker-in-the-middle phishing proxy needs no vulnerability; it exploits the fact that most authentication factors produce something forwardable. Some techniques and CVEs reference each other where a CVE is a known instance of a broader technique.
- How does this map to MITRE ATT&CK?
- Every brief lists the MITRE ATT&CK technique IDs it corresponds to (for example T1557 for adversary-in-the-middle) and the tactics involved. We link to the authoritative ATT&CK page rather than duplicating its content, and add the detection and mitigation guidance specific to identity systems that ATT&CK itself does not prescribe.
Community
Help keep the catalog honest
Seeing a technique in the wild we have not covered, or a detection idea that works better than what is written here? Email community@startwithidentity.com or volunteer as a CVE Analyst. Corrections are credited.