<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: detecting-identity-based-attacks
description: >-
  Detect identity-layer ATT&CK techniques including credential abuse,
  authentication protocol attacks, privilege escalation via identity systems,
  and lateral movement using compromised identities.
domain: cybersecurity
subdomain: identity-security
tags:
  - identity-attacks
  - credential-abuse
  - mitre-attack
  - detection-engineering
  - itdr
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1110
  - T1556
  - T1550
  - T1606
---

# Detecting Identity-Based Attacks

## Overview

Identity-based attacks target authentication and authorization systems
to gain initial access, escalate privileges, and move laterally. Detection
requires correlating signals across identity providers, directory services,
federation protocols, and endpoint telemetry. This technique covers detection
patterns for the full spectrum of identity ATT&CK techniques.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### Identity Attack Categories

| Category | ATT&CK Techniques | Key Signals |
|---|---|---|
| Credential Abuse | T1078, T1110 | Failed auth spikes, impossible travel |
| Protocol Attacks | T1606, T1550 | SAML anomalies, token replay |
| Privilege Escalation | T1098, T1136 | Role changes, admin creation |
| Persistence | T1556, T1098 | Auth process modification, MFA changes |
| Lateral Movement | T1550 | Pass-the-hash, pass-the-ticket |

### Detection Architecture

```
┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│  IdP Logs    │    │  Directory   │    │  Endpoint    │
│  (Entra/Okta)│───▶│  Service     │───▶│  Telemetry   │
└──────┬───────┘    └──────┬───────┘    └──────┬───────┘
       │                   │                   │
       └───────────┬───────┴───────────────────┘
                   ▼
          ┌────────────────┐
          │  SIEM / ITDR   │
          │  Correlation   │
          └────────┬───────┘
                   ▼
          ┌────────────────┐
          │  Alert Triage  │
          │  & Response    │
          └────────────────┘
```

## Workflow

```
1. ENUMERATE  — Map identity providers, directories, and federation topology
2. BASELINE   — Establish normal authentication patterns per identity
3. INSTRUMENT — Deploy detection rules for identity ATT&CK techniques
4. CORRELATE  — Cross-reference IdP, directory, and endpoint signals
5. TRIAGE     — Score and prioritize identity alerts by risk
6. RESPOND    — Contain compromised identities and revoke sessions
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
