Identity Attack Chains From Initial Access to Privilege

Key judgments

1. Administrative control is usually reached through a chain of routine identity events, not a single exploit. A convincing call to a help desk, a new MFA registration and a role assignment each look like normal operations. The sequence is what gives them away. Assessment, based on the documented cases below.

2. The time available to break the chain has collapsed. Mandiant reports that the median gap between initial access and handoff to a second criminal group fell from more than eight hours to 22 seconds. CrowdStrike reports an average eCrime breakout time of 29 minutes, with the fastest observed at 27 seconds. The two figures measure different things, but both point the same way. Fact; direction high confidence, exact values moderate.

3. The weakest points sit around the login, not at it. Enrollment, account recovery and non-human identities are where documented intrusions have slipped past MFA. Assessment.

4. Breaking the chain at the second or third stage costs far less than at the fifth or sixth. After privilege is taken, the response becomes a rebuild. Judgment.

The chain, stage by stage

Each stage below is documented in at least one primary or first-party source. The right-hand column is where a defender has a realistic chance of interrupting it.

The help desk is an authentication system

CISA’s Scattered Spider advisory describes callers who pose as employees, persuade support staff to reset passwords, and move MFA enrollment to devices the callers control. The updated advisory notes that these social engineering efforts are more sophisticated than before and often run across several calls, using details taken from social media, open sources and leaked databases. Mandiant, which tracks the same activity as UNC3944, says the group targets IT help desks to bypass MFA and reach SaaS applications. Coveware lists help desk manipulation and MFA and password resets among the routes by which ransomware actors now gain entry.

The practical reading is uncomfortable. A reset procedure that accepts an employee number, a manager’s name and a date of birth is a password that a great many people already know. Strengthening it costs a few minutes per request: a callback to a number on file, approval from the user’s manager through a separate channel, and a rule that administrator and executive resets are never completed on a single call.

Non-human identities sit outside the MFA conversation

Microsoft’s analysis of Storm-0501 is the clearest public illustration. Conditional Access and MFA blocked the attackers when they tried to sign in as privileged users. They then found a synced non-human identity that held the Global Administrator role and had no MFA method registered. They reset its on-premises password, which synchronized to the cloud, registered their own MFA method, and carried on. The control worked for every administrator someone had thought to enroll. It did not cover the one nobody was watching.

Few organizations can say how many service accounts, sync accounts and application identities hold privileged roles, or who owns each. That inventory is the starting point for stage four, because it is the same list the attacker is building.

Speed changes what monitoring has to mean

Nothing in these chains requires malware. A role assignment, an MFA registration or a federation change does not trip endpoint detection. Detection has to come from identity and cloud audit telemetry, and someone must have the authority to act on it quickly. In some Akira incidents described by CISA and its partners, data left the network in just over two hours from initial access. A queue that is reviewed the next morning cannot interrupt that.

The harder question is organizational. Who is permitted to disable a Global Administrator at night, without waiting for a change approval? If the answer is unclear, the chain has a head start.

What to change first

1. Rewrite the reset and enrollment procedure. Out-of-band verification for every MFA change. No single-call resets for privileged or executive accounts.

2. Extend phishing-resistant MFA from users to privilege. Administrator accounts first, then remote access, SaaS administration and backup administration.

3. Inventory privileged non-human identities. Name an owner, remove the roles that are not needed, and require a registered MFA method or equivalent control on every privileged identity that can be given one.

4. Alert on identity persistence events. New MFA methods, new OAuth consents and new federation trusts should each reach a person quickly.

5. Pre-authorize containment. Define who can revoke sessions and disable privileged accounts, and make it a standing decision rather than an incident-time debate.

6. Retain identity logs longer than 90 days. Mandiant notes that standard 90-day retention leaves organizations blind to initial access in long intrusions.

7. Test the chain. Walk the six stages against your own environment and mark every point where you have no telemetry. That map is more useful than a vulnerability count.

Where this brief is limited

The sources count different things. Mandiant’s handoff time measures the gap between two criminal groups. CrowdStrike’s breakout time measures how long an intruder takes to move from the first compromised host to others. They should not be treated as interchangeable. None of the sources used here gives the share of all breaches that follow this full chain, so the brief makes no such claim. Several named cases come from Microsoft environments. That reflects where detailed public reporting exists and says little about how other identity platforms compare.

Questions for leadership

• Can our help desk change an administrator’s MFA on a single phone call?

• Which privileged identities in our environment have no MFA method registered, and who owns each of them?

• Who can disable a privileged account at two in the morning, and do they know they can?

Sources

• Mandiant (Google Threat Intelligence), M-Trends report — Annual analysis of Mandiant incident response investigations

• CrowdStrike, Global Threat Report announcement — Adversary tracking and breakout-time findings

• CISA and partners, Scattered Spider joint advisory — Government advisory with updated tactics and mitigations

• Microsoft Threat Intelligence, Storm-0501 and cloud-based ransomware — First-party incident analysis

• Coveware, adverse cyber extortions are more common than commonly advised — Quarterly ransomware negotiation analysis

• CISA, FBI and partners, Akira ransomware joint advisory — Government advisory, updated edition