<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-identity-detection-engineering
description: >-
  Engineer detection rules for identity-based threats including credential abuse, privilege escalation, lateral movement, and identity provider attacks across Active Directory and cloud IAM.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - identity-detection
  - active-directory
  - credential-abuse
  - privilege-escalation
  - oauth
  - identity-provider
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Performing Identity Detection Engineering

## Overview

Identity detection engineering targets authentication and authorization abuse
across enterprise identity infrastructure. Covers Active Directory attack
detection, OAuth token abuse, MFA bypass, and identity provider compromise.

## Prerequisites

| Requirement | Purpose |
|---|---|
| AD audit logs | Windows Security Event Logs enabled |
| IdP logs | Azure AD, Okta, or equivalent audit logs |
| SIEM access | Log aggregation and query capability |

## Key Concepts

### Identity Threat Detection Patterns

```yaml
# Sigma rule for Kerberoasting detection
title: Kerberoasting Service Ticket Request
id: 9e2b1a3c-4d5f-6e7a-8b9c-0d1e2f3a4b5c
status: experimental
description: >-
  Detects suspicious Kerberos service ticket requests that may
  indicate Kerberoasting activity targeting service accounts.
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketEncryptionType: "0x17"
    ServiceName|endswith:
      - "$"
  filter_machine:
    ServiceName|endswith: "$"
  condition: selection and not filter_machine
level: high
tags:
  - attack.credential_access
  - attack.t1558.003
```

## Workflow

1. **Map identity threats** — Catalog credential abuse and escalation techniques
2. **Inventory identity logs** — Ensure AD, IdP, and MFA logs are collected
3. **Author detections** — Write rules for authentication and authorization abuse
4. **Baseline identity behavior** — Profile normal login patterns and access
5. **Test with simulations** — Execute controlled credential attacks for validation
6. **Tune for environment** — Filter service accounts and automated processes
7. **Deploy and correlate** — Push rules and enable cross-source identity correlation

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
