# What is an Identity-Based Attack?

> An identity-based attack is an industry umbrella term for an attack that targets or abuses digital identities, credentials, authenticators, sessions, entitlements, or identity infrastructure to obtain or retain unauthorized access.

- Canonical URL: https://yellowcube.eu/glossary/identity-based-attack/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The attacker may impersonate a valid user or workload, alter how trust is issued, or exploit legitimate permissions after authentication, allowing malicious activity to resemble normal access.

Attack paths include phishing, password spraying, credential stuffing, token or cookie theft, malicious application consent, help-desk manipulation, unauthorized role assignment, service-account compromise, and forged federation assertions. Defenders need evidence from identity providers, directories, endpoints, applications, cloud control planes, and privileged systems because no single log shows the whole sequence.

### Key points

- **Initial access:** Stolen or guessed credentials, compromised sessions, unsafe enrollment, and abused recovery processes can provide an apparently valid entry path.
- **Persistence and privilege:** Attackers may add authenticators, create accounts, grant roles, register applications, change federation settings, or retain refresh tokens.
- **Detection and response:** Correlate authentication and administrative events, revoke sessions and tokens, rotate affected secrets, remove unauthorized changes, and preserve evidence.
- **Important limitation:** Multi-factor authentication reduces some identity attacks but cannot by itself stop stolen sessions, malicious consent, compromised endpoints, weak recovery, or control-plane changes made with existing privilege.

### Related terms

[Account takeover (ATO)](<https://yellowcube.eu/glossary/account-takeover/>) · [Identity threat detection and response (ITDR)](<https://yellowcube.eu/glossary/identity-threat-detection-and-response/>) · [Login credentials](<https://yellowcube.eu/glossary/login-credentials/>) · [Phishing](<https://yellowcube.eu/glossary/phishing/>) · [Privileged access management (PAM)](<https://yellowcube.eu/glossary/privileged-access-management/>)

### Sources

[MITRE ATT&CK T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/) · [CISA and NSA: Identity and Access Management Recommended Best Practices](https://www.cisa.gov/sites/default/files/2023-12/ESF%20IDENTITY%20AND%20ACCESS%20MANAGEMENT%20RECOMMENDED%20BEST%20PRACTICES%20FOR%20ADMINISTRATORS%20PP-23-0248_508C.pdf)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.