Identity attack techniques
A vulnerability is a bug in one product. A technique is a repeatable way to break identity that does not need one. These briefs cover how identity attacks actually work: what an attacker does, why the control they exploit fails, how to detect the attempt, and how to close it, mapped to MITRE ATT&CK.
Start with the control an attacker targets, or browse every brief below.
Attacks on authentication
Techniques that defeat the login itself: real-time phishing proxies, factor relay, enrolment abuse, and credential guessing. Almost none of them break cryptography.
A reverse proxy sits between the user and the real login page, relays every step of authentication including MFA, and keeps the session cookie the successful login produces.
Attackers replay username and password pairs leaked from one breach against every other login page they can reach, betting on the well-documented habit of password reuse.
The victim enters a code on Microsoft's own login page and approves a real prompt. The attacker requested that code from a second device and walks away with access and refresh tokens.
The attacker already has a password. They trigger push approval prompts until a tired or confused user taps approve, sometimes with a fake IT message to speed the decision along.
The attacker starts a real login and calls the victim posing as support, asking them to read back the one-time code that just arrived. The code is genuine; the request is not.
Instead of guessing many passwords against one account and triggering a lockout, the attacker guesses a few common passwords against many accounts, staying under the threshold for each one.
Code already running in a signed-in Windows session can drive the device's own Windows Hello key to obtain a Primary Refresh Token, no PIN prompt, no admin rights, no CVE required.
A refresh token exists to let an app get new access tokens without bothering the user again. Stolen, it lets an attacker do the same thing indefinitely, surviving password resets along the way.
A session cookie is a bearer credential that proves nothing beyond possession. Whoever copies it inherits the logged-in session, skipping the password and the MFA challenge that produced it.
The victim never types a password. They click a legitimate 'Sign in with' button, land on the real identity provider, and approve an attacker-registered application's request for mailbox and file access.
A phone call to IT support, not a login attempt, is the actual attack. The target's strong password and MFA enrollment never come into play, because the attacker gets a human to reset both.
A certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.
A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.
A passkey or Windows Hello key is supposed to stay locked to its device. Code running on an already-compromised endpoint can pull the key material out of the process that holds it, or drive it without the fresh check meant to gate its use.
Commodity malware on an endpoint reads whatever the browser and OS have stored in the clear or under a key the same machine already holds, then ships it to a marketplace where the credentials outlive the machine they came from.
Attacks on sessions and tokens
Techniques that skip the login and go straight for what it produces: stolen cookies, replayed access tokens, and refresh credentials that outlive a password reset.
A reverse proxy sits between the user and the real login page, relays every step of authentication including MFA, and keeps the session cookie the successful login produces.
The victim enters a code on Microsoft's own login page and approves a real prompt. The attacker requested that code from a second device and walks away with access and refresh tokens.
Code already running in a signed-in Windows session can drive the device's own Windows Hello key to obtain a Primary Refresh Token, no PIN prompt, no admin rights, no CVE required.
A refresh token exists to let an app get new access tokens without bothering the user again. Stolen, it lets an attacker do the same thing indefinitely, surviving password resets along the way.
A session cookie is a bearer credential that proves nothing beyond possession. Whoever copies it inherits the logged-in session, skipping the password and the MFA challenge that produced it.
A token that is not bound to the client, session, or challenge that requested it can be lifted once and replayed anywhere the check for binding is missing, no matter how it was strengthened.
A broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.
A chain of services each meant to narrow a token's authority instead widens it, because one hop in the delegation path trusts the scope a caller claims rather than the scope it was actually issued.
Commodity malware on an endpoint reads whatever the browser and OS have stored in the clear or under a key the same machine already holds, then ships it to a marketplace where the credentials outlive the machine they came from.
Attacks on authorization
Techniques that leave the login alone and attack what an authenticated identity is allowed to do: consent abuse, scope escalation, and delegation chains that quietly widen access.
A broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.
The victim never types a password. They click a legitimate 'Sign in with' button, land on the real identity provider, and approve an attacker-registered application's request for mailbox and file access.
A chain of services each meant to narrow a token's authority instead widens it, because one hop in the delegation path trusts the scope a caller claims rather than the scope it was actually issued.
Attacks on identity lifecycle
Techniques that target joiner, mover, and leaver: help desk resets granted on weak proof, entitlements that accumulate across role changes, and accounts nobody remembered to disable.
A phone call to IT support, not a login attempt, is the actual attack. The target's strong password and MFA enrollment never come into play, because the attacker gets a human to reset both.
An employee who changes roles keeps every entitlement from every prior role, because provisioning adds access automatically and nothing removes the old access automatically.
An account left active after its owner departed or its purpose ended draws no attention from anyone, because no one owns it, no one expects a login from it, and no one is watching for one.
Attacks on directory and trust
Techniques that go after the directory itself: Kerberos ticket forgery, certificate services, federation trust, and forest-to-forest compromise. When these fall, everything that trusts them falls with them.
A certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.
A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.
Any authenticated domain user can request a Kerberos service ticket for any service principal, and that ticket is encrypted with the service account's own password hash, offline and unrateable to test.
Delegation lets a service act as the user who called it, which is necessary for multi-tier applications and dangerous the moment the service or the delegation scope is not exactly what an administrator intended.
Attacks on credential storage
Techniques that target where secrets rest rather than how they are used: infostealer malware, secrets left in source repositories and CI logs, and key extraction from the vaults meant to protect them.
Any authenticated domain user can request a Kerberos service ticket for any service principal, and that ticket is encrypted with the service account's own password hash, offline and unrateable to test.
A passkey or Windows Hello key is supposed to stay locked to its device. Code running on an already-compromised endpoint can pull the key material out of the process that holds it, or drive it without the fresh check meant to gate its use.
Commodity malware on an endpoint reads whatever the browser and OS have stored in the clear or under a key the same machine already holds, then ships it to a marketplace where the credentials outlive the machine they came from.
A credential committed to a config file or pasted into a pipeline variable travels with every clone, fork, and log line, and it keeps working for as long as nobody notices it left the vault.
A static API key has no expiry, no built-in scope beyond what was granted at creation, and no way to tell whether the caller presenting it is the workflow it was issued to or whoever found it in a public commit.
Attacks on non-human identity
Techniques that target service accounts, workload identities, and AI agents rather than people: static keys that never rotate, delegation confusion between chained services, and instruction injection against autonomous agents.
A broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.
A credential committed to a config file or pasted into a pipeline variable travels with every clone, fork, and log line, and it keeps working for as long as nobody notices it left the vault.
An AI coding agent reads whatever text is in front of it, an issue, a title, a comment, and treats it as instruction. If that runner also holds workflow secrets, the text an anonymous account typed becomes something the credential can execute.
A static API key has no expiry, no built-in scope beyond what was granted at creation, and no way to tell whether the caller presenting it is the workflow it was issued to or whoever found it in a public commit.
How to use this catalog
Identity attack techniques: frequently asked questions
- What is an identity attack technique?
- A technique brief describes a repeatable method an attacker uses against authentication, sessions, authorization, or the directory itself, independent of any single product or vulnerability. It covers how the method works, why the underlying control assumption fails, how to detect it, and how to stop it.
- How is this different from a CVE?
- A CVE is a specific flaw in a specific product, tied to a version and a patch. A technique is a pattern of attack that works across many products and does not require a bug at all. An attacker-in-the-middle phishing proxy needs no vulnerability; it exploits the fact that most authentication factors produce something forwardable. Some techniques and CVEs reference each other where a CVE is a known instance of a broader technique.
- How does this map to MITRE ATT&CK?
- Every brief lists the MITRE ATT&CK technique IDs it corresponds to (for example T1557 for adversary-in-the-middle) and the tactics involved. We link to the authoritative ATT&CK page rather than duplicating its content, and add the detection and mitigation guidance specific to identity systems that ATT&CK itself does not prescribe.
Help keep the catalog honest
Seeing a technique in the wild we have not covered, or a detection idea that works better than what is written here? Email [email protected] or volunteer as a CVE Analyst. Corrections are credited.