<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: analyzing-authentication-anomalies
description: >-
  Analyzes authentication anomalies including impossible travel, credential stuffing,
  password spraying, MFA bypass, token theft, and anomalous service account usage
  across identity providers and directory services.
domain: cybersecurity
subdomain: incident-response
tags:
  - authentication
  - identity-attacks
  - credential-stuffing
  - password-spraying
  - MFA-bypass
  - impossible-travel
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Analyzing Authentication Anomalies

## Overview

Authentication anomaly analysis detects identity-based attacks including credential
stuffing, password spraying, MFA fatigue/bypass, impossible travel, token theft,
and compromised service accounts. Identity is the new perimeter — over 80% of
breaches involve compromised credentials (Verizon DBIR).

This skill covers detection across Active Directory, Azure AD/Entra ID, Okta,
and cloud provider IAM. Analysis techniques range from statistical baselines to
specific attack pattern signatures.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| PowerShell AD module | Active Directory queries | `Install-Module ActiveDirectory` |
| Azure AD PowerShell | Entra ID investigation | `Install-Module AzureAD` |
| Splunk / Elastic | Log aggregation and search | Existing deployment |
| Microsoft Graph API | Entra ID sign-in logs | API access configured |
| Okta System Log API | Okta authentication events | API token required |

## Key Concepts

### Authentication Attack Patterns

| Attack | Pattern | Detection |
|--------|---------|-----------|
| Password Spraying | Many users, few passwords, slow cadence | Failed logins across many accounts from few IPs |
| Credential Stuffing | Known credentials, rapid attempts | High volume failures from distributed IPs |
| MFA Fatigue | Repeated MFA push notifications | Multiple MFA denials followed by approval |
| Impossible Travel | Logins from distant locations | Two logins < travel time between geolocations |
| Token Theft | Stolen session/refresh token | Auth from new device with existing session |
| Golden SAML | Forged SAML assertions | Logon without corresponding IdP event |

### Critical Log Sources

| Source | Events |
|--------|--------|
| Windows Security Log | 4624, 4625, 4648, 4768, 4769, 4771 |
| Azure AD Sign-in Logs | Interactive, non-interactive, service principal |
| Okta System Log | user.session.start, user.authentication.* |
| AWS CloudTrail | ConsoleLogin, AssumeRole, GetSessionToken |

## Workflow

### Step 1 — Detect Password Spraying

```bash
# Splunk — password spray detection (many users, single IP)
splunk search '
  index=wineventlog EventCode=4625
  | stats dc(TargetUserName) as unique_users count by src_ip
  | where unique_users > 10 AND count > 20
  | sort -unique_users
'

# KQL — Azure AD password spray
SigninLogs
| where ResultType == "50126"
| summarize FailureCount=count(), DistinctUsers=dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 1h)
| where DistinctUsers > 10
| sort by DistinctUsers desc
```

### Step 2 — Detect Impossible Travel

```bash
# KQL — Azure AD impossible travel
SigninLogs
| where ResultType == 0
| project TimeGenerated, UserPrincipalName, IPAddress, Location
| sort by UserPrincipalName, TimeGenerated asc
| extend PrevTime = prev(TimeGenerated, 1), PrevLocation = prev(Location, 1), PrevUser = prev(UserPrincipalName, 1)
| where UserPrincipalName == PrevUser
| extend TimeDiffMinutes = datetime_diff('minute', TimeGenerated, PrevTime)
| where TimeDiffMinutes < 120 and Location != PrevLocation
```

### Step 3 — Detect MFA Fatigue / Bypass

```bash
# KQL — MFA denial followed by success
AADNonInteractiveUserSignInLogs
| where ResultType in ("50074", "500121")
| summarize Denials=count() by UserPrincipalName, bin(TimeGenerated, 30m)
| where Denials >= 5

# Splunk — Okta MFA fatigue
splunk search '
  index=okta eventType="user.authentication.auth_via_mfa"
  | eval status=mvindex(split(outcome.result, "."), -1)
  | stats count(eval(status="FAILURE")) as denials count(eval(status="SUCCESS")) as approvals by actor.displayName
  | where denials >= 5 AND approvals >= 1
'
```

### Step 4 — Detect Anomalous Service Account Usage

```bash
# Splunk — service account interactive logon (should never happen)
splunk search '
  index=wineventlog EventCode=4624 LogonType=2
  | search TargetUserName="svc_*" OR TargetUserName="sa_*"
  | table _time, TargetUserName, src_ip, WorkstationName
'

# KQL — service principal from unexpected IP
AADServicePrincipalSignInLogs
| where IPAddress !in ("10.0.1.0/24", "10.0.2.0/24")
| project TimeGenerated, ServicePrincipalName, IPAddress, ResourceDisplayName
```

### Step 5 — Investigate Kerberos Attacks

```powershell
# Kerberoasting detection — TGS requests with RC4 encryption
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769} |
  Where-Object { $_.Properties[5].Value -eq "0x17" } |
  Select-Object TimeCreated,
    @{N='User';E={$_.Properties[0].Value}},
    @{N='Service';E={$_.Properties[2].Value}},
    @{N='Encryption';E={$_.Properties[5].Value}}

# AS-REP Roasting — pre-auth disabled accounts
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth |
  Select-Object SamAccountName, Enabled, DoesNotRequirePreAuth
```

## Detection

```yaml
title: Authentication Anomalies Detection
id: 455b24c8-a3a3-4726-a903-8d5cd52d74d0
status: experimental
description: Detects suspicious activity related to analyzing authentication anomalies techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*authentication*"
  condition: selection
level: high
tags:
  - attack.t1078
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] Password spraying patterns analyzed (multi-user failures from single source)
- [ ] Impossible travel detections reviewed with geolocation correlation
- [ ] MFA fatigue attacks checked (repeated denials then success)
- [ ] Service account usage audited for interactive logon anomalies
- [ ] Kerberos attack indicators reviewed (RC4 TGS requests, AS-REP)
- [ ] Token/session anomalies checked (device mismatch, impossible concurrency)
- [ ] Compromised credentials identified and rotation initiated
- [ ] Authentication-based IOCs extracted and documented

## References

- Verizon Data Breach Investigations Report (DBIR)
- MITRE ATT&CK T1110 (Brute Force)
- MITRE ATT&CK T1078 (Valid Accounts)
- MITRE ATT&CK T1558 (Steal or Forge Kerberos Tickets)
- MITRE ATT&CK T1621 (Multi-Factor Authentication Request Generation)
- Microsoft Entra ID Sign-in Logs Documentation
