Identity: attacks, pivoting & IAM hardening

Identity is the primary attack surface in modern enterprise environments. An identity represents any entity — user, service account, workload, or machine — authenticated by a directory or identity provider such as Active Directory, Azure AD, or Okta. Attackers target identity because compromising a valid credential grants legitimate access without triggering traditional signature-based detections. The core mechanisms exploited include password-based authentication weaknesses, token forgery, Kerberos ticket abuse, and OAuth flow manipulation. Identity is relevant across every phase of the kill chain: initial access via phishing or credential stuffing, persistence via backdoored service accounts, lateral movement via Pass-the-Hash or Pass-the-Ticket, and privilege escalation via misconfigured role assignments. Unlike network-based attacks, identity attacks rarely generate unusual traffic patterns. They blend into normal authentication flows. This makes identity the hardest attack surface to monitor without dedicated tooling. Understanding identity trust chains — how a compromised account in one domain can pivot to another — is foundational for both Red Team operators and Blue Team defenders building detection coverage across hybrid and cloud environments.

Detecting identity attacks requires correlating authentication events across multiple log sources simultaneously. On Windows Active Directory environments, Event ID 4624 (successful logon) and 4625 (failed logon) are baseline telemetry. Event ID 4768 and 4769 track Kerberos TGT and service ticket requests. Anomalous RC4 encryption type usage in 4769 events is a strong indicator of Kerberoasting activity. Event ID 4776 covers NTLM authentication and helps identify Pass-the-Hash patterns when combined with logon type 3 from unexpected sources. In Azure AD or Entra ID environments, the Unified Audit Log and Sign-In Logs expose impossible travel, legacy authentication protocol usage, and token replay attacks. SIEM correlation rules should flag accounts authenticating from multiple geographies within short time windows. Privileged Identity Management (PIM) activation events and sudden role assignment changes deserve dedicated alerting. Tools like Microsoft Sentinel, Splunk, or Elastic SIEM with identity-focused detection packs accelerate coverage. Behavioral baselines per account — normal logon hours, source IP ranges, accessed resources — are essential for reducing false positives and surfacing genuine compromised identity indicators.

Red Team operators treat identity as the primary pivot path through an environment. Initial foothold typically leverages phishing to capture credentials or harvest NTLM hashes via responder-based techniques. From a low-privilege account, Kerberoasting (requesting service tickets for SPNs and cracking them offline with Hashcat) extracts service account credentials without elevated rights. BloodHound maps identity attack paths by enumerating Active Directory ACLs, group memberships, and delegation settings, revealing shortest routes to Domain Admin. Pass-the-Hash and Pass-the-Ticket allow lateral movement using extracted NTLM hashes or Kerberos tickets via Mimikatz or Rubeus without knowing the plaintext password. In cloud environments, stolen OAuth tokens or misconfigured service principal permissions enable privilege escalation within Azure or AWS IAM. Hardening measures include enforcing MFA everywhere without legacy protocol exceptions, disabling NTLM where feasible, applying tiered administration models (Microsoft's Enterprise Access Model), rotating service account credentials regularly, and running Kerberos with AES256 exclusively. Privileged Access Workstations (PAWs) and just-in-time access policies reduce the blast radius of any single compromised identity significantly.