Identity Attack: techniques and defense methods

An identity attack is any offensive technique that targets authentication mechanisms, credentials, or identity providers to gain unauthorized access to systems or data. Identity attacks exploit weaknesses in how users, services, and machines prove who they are. Common vectors include credential stuffing, pass-the-hash, pass-the-ticket, Kerberoasting, and token hijacking. In Active Directory environments, attackers frequently abuse Kerberos delegation, NTLM relay, or AS-REP roasting to obtain valid tickets or hashes without knowing plaintext passwords. Cloud environments introduce additional surfaces: OAuth token theft, service principal abuse, and consent phishing all fall under the identity attack category. What makes these attacks particularly dangerous is their ability to blend into legitimate authentication traffic. A successful identity attack often grants the adversary the same access as the compromised account, bypassing perimeter controls entirely. Identity is now the primary attack surface in hybrid environments where on-premises directories federate with cloud identity providers such as Entra ID or Okta.

Detecting identity attacks requires monitoring authentication events at multiple layers simultaneously. On Windows endpoints, Event ID 4625 flags failed logon attempts, while Event ID 4768 and 4769 cover Kerberos ticket requests. A spike in 4769 events with RC4 encryption type (0x17) is a strong Kerberoasting indicator. Event ID 4776 logs NTLM authentication attempts and can reveal relay activity. LDAP queries targeting Service Principal Names should be correlated with Zeek or network sensors. In cloud environments, Entra ID sign-in logs expose impossible travel, legacy protocol usage, and service principal logins from unusual locations. SIEM rules should flag accounts requesting an abnormal number of service tickets within a short timeframe. Lateral movement following an identity attack typically surfaces through Event ID 4648 (explicit credentials) and 4624 logon type 3 or 9. Deception tokens, such as honey accounts with no legitimate use, generate high-fidelity alerts when accessed. Endpoint Detection and Response tools with credential access telemetry can catch LSASS memory reads associated with tools like Mimikatz.

Red teams simulate identity attacks to measure detection coverage and validate identity hardening controls. Kerberoasting is executed by requesting service tickets for accounts with SPNs, then cracking them offline with Hashcat using wordlists and rules. Pass-the-hash leverages NTLM hashes extracted from LSASS memory via Mimikatz or Impacket's secretsdump module. Pass-the-ticket uses stolen Kerberos TGTs or service tickets injected directly into session memory with Rubeus. For cloud targets, roadtx and TokenTacticsV2 automate OAuth token extraction and refresh token abuse against Entra ID. Counter-measures include enforcing AES-only Kerberos encryption to neutralize RC4-based attacks, enabling Protected Users security group membership for privileged accounts, deploying Credential Guard to block LSASS memory access, and applying Conditional Access policies with phishing-resistant MFA. Tiered administration models limit the blast radius of a single compromised identity. Regular auditing of accounts with SPNs, unconstrained delegation, and excessive Kerberos privileges directly reduces the exploitable attack surface.