By SC Media Editorial Intelligence, reviewed by Dustin Sachs
Attack Surfaces and Threat Vectors
Password breaches create immediate risk across all enterprise accounts using the same credentials. Attackers use previously compromised password databases against corporate login portals through credential stuffing attacks, requiring only automated tools and leaked credential lists. Brute force attacks target weak passwords through automated login attempts against authentication endpoints. Account lockout policies and impossible travel pattern monitoring limit these attacks' effectiveness.Multi-factor authentication bypass techniques defeat secondary security layers through SIM swapping, which redirects SMS-based second factors to attacker-controlled devices. Push notification fatigue attacks overwhelm users with MFA prompts until they approve malicious requests to stop the bombardment. Phishing sites capture both passwords and one-time codes in real-time by proxying authentication flows. FIDO2 hardware tokens or certificate-based authentication resist these bypass methods but require hardware distribution and user training.Directory services attacks exploit Active Directory and cloud identity providers through native protocol weaknesses. Kerberoasting extracts service account password hashes for offline cracking by requesting service tickets with weak encryption. ASREPRoasting targets accounts with "Do not require Kerberos preauthentication" enabled, allowing password hash extraction without authentication. Golden ticket attacks use compromised krbtgt account hashes to forge unlimited authentication tokens. Service account password rotation frequency reduces exposure time but may destabilize applications during rotation windows.Privileged account abuse escalates access through legitimate administrative functions. Token theft attacks extract OAuth tokens from browser memory or storage locations. Pass-the-hash techniques use NTLM hashes without knowing plaintext passwords, enabling lateral movement across Windows networks. Privileged access management solutions with just-in-time elevation contain these attacks by limiting permanent administrative access.Cloud identity provider attacks exploit federated authentication weaknesses across multiple connected applications. SAML assertion manipulation bypasses authentication by forging identity tokens between identity providers and service providers. OAuth redirect URI manipulation sends authorization codes to attacker-controlled endpoints during the authorization flow. Single sign-on compromise affects all connected applications in the federation trust relationship.Detection Guidance
Identity attack detection requires monitoring authentication events, directory service activity, and privileged account usage across multiple log sources.Authentication anomaly detection identifies suspicious login patterns through impossible travel scenarios where accounts authenticate from geographically distant locations within short timeframes. (Source: MITRE ATT&CK) Query pattern: source_ip_country != previous_ip_country AND time_diff < 60_minutes. Failed login monitoring should trigger alerts after five consecutive failures from the same source IP. Alert volume increases with distributed attacks but provides coverage for credential spray techniques.Kerberos attack detection focuses on service ticket requests and encryption downgrades through domain controller event monitoring. Kerberoasting generates distinctive patterns in authentication logs. Detection rule: event_id=4769 AND service_name!="krbtgt" AND encryption_type="RC4_HMAC". ASREPRoasting creates authentication requests without pre-authentication. Query: event_id=4768 AND pre_auth_type="0".Directory service monitoring tracks unusual LDAP queries and group membership changes that indicate reconnaissance or privilege escalation. Excessive LDAP queries from single sources indicate reconnaissance activity. Detection threshold: more than 100 unique object queries per minute from single IP. (Source: attack.mitre.org) Group membership modifications outside maintenance windows require investigation. (Source: learn.microsoft.com) Baseline query volumes during business hours versus off-hours improve detection accuracy.Token and session abuse detection monitors authentication artifacts and session behavior for signs of credential theft. OAuth token usage from new IP addresses should generate alerts for high-privilege accounts. Session duration monitoring identifies tokens that remain active beyond normal working hours. Browser user-agent changes within active sessions indicate potential token theft between different devices or applications.Privileged access monitoring requires real-time alerting on administrative actions to prevent damage from compromised accounts. Administrative group membership changes require immediate notification to security teams. Service account password changes outside scheduled rotations indicate compromise or unauthorized administrative activity. Privileged access management platforms with built-in monitoring provide better visibility than native directory logs alone.Expert Commentary
"Identity compromise remains one of the most common entry points for enterprise breaches, with attackers targeting credentials, privileged accounts, authentication systems, and identity infrastructure to gain persistent access and move laterally across environments. Common attack methods include password spraying, credential stuffing, phishing, social engineering, token theft, and exploitation of legacy authentication protocols such as NTLM. Privileged accounts, service accounts, and federated authentication systems create particularly high-risk attack surfaces because they often possess broad permissions and weak monitoring controls. Effective defense requires continuous authentication monitoring, anomaly detection, privileged account oversight, and identity infrastructure hardening. Organizations should implement phishing-resistant MFA, least-privilege access, just-in-time administrative privileges, network segmentation, and strong session management controls. Monitoring for unusual login behavior, suspicious Active Directory changes, token anomalies, and interactive service account usage is essential for detecting compromise early. Modern identity defense strategies increasingly align with Zero Trust principles and identity-centric security architectures.
Credential compromise costs enterprises an average of $4.88 million per breach, with identity attacks serving as the initial access vector in 80% of successful intrusions. These attacks succeed by compromising credentials, exploiting weak identity controls, or abusing legitimate identity management features to gain unauthorized access and escalate privileges. Identity attacks target the authentication and authorization systems that control access to enterprise resources." — Dustin Sachs
