The attacker may impersonate a valid user or workload, alter how trust is issued, or exploit legitimate permissions after authentication, allowing malicious activity to resemble normal access.
Attack paths include phishing, password spraying, credential stuffing, token or cookie theft, malicious application consent, help-desk manipulation, unauthorized role assignment, service-account compromise, and forged federation assertions. Defenders need evidence from identity providers, directories, endpoints, applications, cloud control planes, and privileged systems because no single log shows the whole sequence.
Key points
Initial accessStolen or guessed credentials, compromised sessions, unsafe enrollment, and abused recovery processes can provide an apparently valid entry path.
Persistence and privilegeAttackers may add authenticators, create accounts, grant roles, register applications, change federation settings, or retain refresh tokens.
Detection and responseCorrelate authentication and administrative events, revoke sessions and tokens, rotate affected secrets, remove unauthorized changes, and preserve evidence.
Important limitationMulti-factor authentication reduces some identity attacks but cannot by itself stop stolen sessions, malicious consent, compromised endpoints, weak recovery, or control-plane changes made with existing privilege.