Advanced Evasion (Behavioral)
• Mimic working hours — act during office time
(- attackers operate only during normal working hours)
• Match user typing patterns — avoid anomalies
(- attackers simulate realistic command timing)
• Use approved applications — blend with normal traffic
(- attackers use trusted apps to communicate)
• Limit command frequency — reduce suspicious activity
(- attackers issue commands slowly)
• Rotate access methods — avoid pattern detection
(- attackers switch between tools and techniques)
• Adaptive activity throttling — slow down when monitored
(- attackers reduce activity when detection risk increases)
Advanced Infrastructure Control
• Network segmentation bypass — cross internal zones
(- attackers move between segmented networks)
• Internal routing manipulation — redirect traffic
(- attackers alter routing to intercept traffic)
• Proxy chain inside network — hide internal movement
(- attackers route traffic through multiple internal hosts)
• Internal certificate abuse — trusted encrypted traffic
(- attackers use trusted certificates to hide communication)
• Service dependency exploitation — move via dependencies
(- attackers pivot through systems that depend on each other)
• Infrastructure redundancy abuse — survive remediation
(- attackers create multiple control points across infrastructure)
Advanced Long-Term Objectives
• Strategic intelligence collection — gather business insights
(- attackers collect internal strategic information)
• Competitive information theft — steal market data
(- attackers target pricing, strategy, and product data)
• Long-term credential harvesting — build credential pool
(- attackers continuously collect credentials)
• Future attack preparation — stage later operations
(- attackers prepare tools and access for future attacks)
• Access resale preparation — sell network access
(- attackers prepare access to sell to others)
• Persistent espionage campaign — continuous hidden presence
(- attackers maintain long-term surveillance)
Advanced Enterprise Control
• Tiered admin model bypass — attackers jump between admin levels
(- attackers bypass tiered admin separation to gain higher privileges)
• Privileged access workstation compromise — control admin machines
(- attackers compromise systems used by administrators)
• Domain trust escalation — expand control to trusted domains
(- attackers exploit domain trusts to gain wider control)
• Enterprise admin privilege takeover — full forest control
(- attackers obtain enterprise-level administrative privileges)
• Delegated admin abuse — misuse delegated permissions
(- attackers abuse delegated administrative rights)
• Administrative boundary bypass — cross security boundaries
(- attackers bypass administrative separation controls)
Advanced Identity Persistence
• Token signing key backdoor — create valid authentication tokens
(- attackers steal or add signing keys to generate trusted login tokens)
• Hidden federation trust — persistent external login path
(- attackers create federation trusts allowing external authentication)
• Conditional access exception creation — whitelist attacker access
(- attackers add exclusions in conditional access policies)
• Identity sync rule manipulation — restore deleted accounts
(- attackers modify sync rules to recreate removed identities)
• Privileged role scheduling abuse — auto-enable admin rights
(- attackers schedule temporary roles to activate automatically)
• Service identity persistence — long-term service access
(- attackers create or modify service identities with persistent access)
Advanced Cloud Infrastructure Control
• Resource policy backdoors — hidden access rules
(- attackers insert hidden IAM or resource policies granting access)
• Cloud network security group abuse — open hidden access
(- attackers modify security groups to allow covert connectivity)
• Serverless function persistence — hidden automated access
(- attackers deploy serverless functions that recreate access)
• Managed identity privilege escalation — gain higher permissions
(- attackers elevate managed identities to privileged roles)
• Infrastructure-as-code poisoning — persistent malicious configs
(- attackers modify IaC templates to deploy backdoors repeatedly)
• Cloud control plane compromise — control cloud environment
(- attackers gain access to cloud management APIs)
Advanced Network-Level Manipulation
• Internal traffic redirection — intercept internal communication
(- attackers redirect traffic through controlled systems)
• Transparent proxy insertion — monitor traffic silently
(- attackers insert hidden proxies into network paths)
• Certificate-based interception — decrypt secure traffic
(- attackers use trusted certificates to intercept TLS traffic)
• Routing table manipulation — redirect network paths
(- attackers modify routing tables to control data flow)
• Network sensor bypass — avoid monitoring tools
(- attackers route traffic around monitoring sensors)
• Internal VPN abuse — move across secure zones
(- attackers use internal VPN connections to pivot)
Advanced Detection Suppression
• SIEM connector disablement — stop security data flow
(- attackers disable SIEM connectors collecting logs)
• Security alert rule modification — reduce alerts
(- attackers modify detection rules to suppress alerts)
• Endpoint telemetry filtering — hide malicious actions
(- attackers filter telemetry events before sending)
• Log retention reduction — shorten forensic visibility
(- attackers reduce log retention periods)
• Audit policy weakening — reduce logging detail
(- attackers change audit policies to capture less data)
• Monitoring agent downgrade — reduce detection capability
(- attackers downgrade or weaken monitoring agents)
Advanced Operational Persistence
• Multi-identity persistence — multiple backdoor accounts
(- attackers create several hidden accounts)
• Redundant access infrastructure — multiple entry points
(- attackers deploy multiple access paths)
• Automated access restoration — recreate removed access
(- attackers automate recreation of deleted permissions)
• Dormant admin account activation — hidden admin accounts
(- attackers maintain unused admin accounts for later use)
• Conditional access persistence — activate only under conditions
(- attackers enable persistence only when safe)
• Cross-environment persistence — cloud and on-prem access
(- attackers maintain access across environments)
Advanced Data Control
• Central file server takeover — access company files
(- attackers gain control of shared file servers)
• Email system bulk export — export all mailboxes
(- attackers export large numbers of mailboxes)
• Database replication abuse — copy entire databases
(- attackers trigger database replication to steal data)
• Backup repository extraction — access historical data
(- attackers retrieve data from backup repositories)
• Document management takeover — access internal documents
(- attackers compromise document platforms)
• Source code repository compromise — access development code
(- attackers gain access to code repositories)
Advanced Stealth Operations
• Low-frequency command execution — minimal suspicious activity
(- attackers execute commands infrequently)
• Legitimate admin tool usage — blend with IT activity
(- attackers use standard admin tools)
• Normal traffic pattern imitation — appear legitimate
(- attackers mimic normal network behavior)
• Activity throttling — slow activity to avoid alerts
(- attackers reduce speed of operations)
• User impersonation operations — act as real users
(- attackers perform actions using compromised identities)
• Multi-session identity rotation — rotate identities
(- attackers switch between multiple compromised accounts)
Advanced Attack Coordination
• Multi-vector attack planning — several entry paths
(- attackers prepare multiple initial access methods at the same time)
• Parallel lateral movement — move across many systems
(- attackers spread simultaneously to multiple machines)
• Staged privilege escalation — gradual permission increase
(- attackers slowly move from user to admin privileges)
• Distributed persistence placement — backdoors in many systems
(- attackers deploy persistence across multiple hosts)
• Coordinated data staging — prepare data in locations
(- attackers collect and stage data on several systems)
• Delayed execution strategy — wait before final action
(- attackers delay the final payload until ready)
Strategic Impact Phase
• Enterprise-wide ransomware deployment — encrypt entire organization
(- attackers deploy ransomware simultaneously across systems)
• Identity infrastructure lockout — block all logins
(- attackers change identity settings to prevent user access)
• Data leak extortion campaign — threaten publication
(- attackers threaten to release stolen data)
• Critical system shutdown — stop key services
(- attackers disable core infrastructure systems)
• Supply chain disruption — impact connected partners
(- attackers target systems connected to partners)
• Long-term operational disruption — sustained business impact
(- attackers maintain ongoing disruption)
Advanced Enterprise Identity Takeover
• Global admin takeover — attacker controls entire tenant
(- attackers obtain highest administrative role)
• Privileged role inheritance abuse — hidden inherited admin rights
(- attackers gain privileges through inherited role assignments)
• Admin consent phishing — attacker gains app permissions
(- attackers trick admins into granting malicious app access)
• Directory role template abuse — create privileged roles
(- attackers modify role templates to grant elevated access)
• Identity protection bypass — avoid risk-based login checks
(- attackers bypass identity protection risk detection)
• Emergency access account compromise — control break-glass accounts
(- attackers compromise emergency admin accounts)
Advanced Authentication Manipulation
• MFA method registration abuse — attacker adds own MFA device
(- attackers register their own MFA method to an account)
• MFA reset workflow abuse — remove victim authentication
(- attackers reset MFA to remove legitimate user control)
• Session token cloning — duplicate active sessions
(- attackers copy session tokens to reuse login sessions)
• Refresh token persistence — long-lived authentication reuse
(- attackers reuse refresh tokens to stay logged in)
• Device registration abuse — register attacker device as trusted
(- attackers add their device to trusted device list)
• Conditional access device spoofing — fake compliant device
(- attackers spoof device compliance checks)
Advanced Privilege Propagation Risks
• Group membership chaining — nested groups can create hidden escalation paths
(- permissions inherited through nested groups can unintentionally grant admin access)
• Role assignment propagation — indirect permission inheritance can grant broader access
(- roles assigned at higher levels automatically extend to more resources)
• Delegated permission expansion — delegated rights can spread further than intended
(- delegated admin rights can allow wider privilege changes)
• Service account privilege reuse — service identities can be abused if overprivileged
(- service accounts with broad permissions can be reused for escalation)
• Shared identity privilege escalation — shared accounts can become escalation points
(- shared credentials can allow privilege escalation across teams)
• Cross-role privilege chaining — combining multiple permissions can create high-risk access
(- several low-risk roles combined can effectively grant admin access)
Advanced Internal Control Risks
• Central management server compromise — one compromise can control many endpoints
(- management servers can push commands to all managed devices)
• Software repository compromise — malicious packages can be distributed internally
(- compromised repositories can deliver malicious software to systems)
• Update management takeover — update systems can push harmful changes
(- attackers controlling update tools can deploy malicious updates)
• Configuration baseline manipulation — security baselines can be weakened centrally
(- baseline settings changed centrally affect many devices)
• Patch approval abuse — malicious updates can be approved as legitimate
(- attackers approve harmful patches through update workflows)
• Endpoint policy modification — device protections can be changed at scale
(- attackers modify endpoint policies across the environment)
Advanced SaaS Platform Risks
• Admin API abuse — platform control can be misused through automation
(- admin APIs can be used to automate large-scale changes)
• Bulk export feature abuse — large amounts of data can be downloaded quickly
(- export features allow rapid data extraction)
• Collaboration rule manipulation — documents can be auto-shared without notice
(- sharing rules can automatically expose files externally)
• Notification rule redirection — alerts can be hidden from defenders
(- notification settings can redirect security alerts)
• Audit log configuration abuse — visibility can be reduced by changing settings
(- logging configuration changes reduce monitoring visibility)
• External sharing persistence — outside access can remain active for long periods
(- shared links or guest access can remain enabled unnoticed)
Advanced Data Targeting Risks (Precision)
• Sensitive project targeting — attackers may focus on key internal initiatives
(- attackers search for documents related to strategic projects)
• Legal document extraction — legal files may expose strategy and risk
(- contracts and legal files contain sensitive information)
• Financial forecast extraction — planning data can reveal future direction
(- forecasts expose financial and strategic planning)
• Customer database extraction — client data is a high-value target
(- customer databases contain valuable personal and business data)
• Vendor contract extraction — agreements can expose pricing and dependencies
(- vendor contracts reveal pricing structures and relationships)
• Executive communication targeting — leadership messages often contain sensitive decisions
(- executive emails and messages contain strategic decisions)
Advanced Stealth Persistence Risks
• Time-delayed account activation — hidden access may activate later
(- dormant accounts are created and activated only after long delays)
• Conditional permission grants — privileges may appear only under certain conditions
(- access is granted only when specific rules are met)
• Shadow admin assignments — hidden admin rights can remain unnoticed
(- admin roles are assigned in obscure locations)
• Temporary privilege escalation loops — recurring short admin access can avoid attention
(- short-lived admin roles activate repeatedly)
• Recreated service accounts — deleted access may be silently restored
(- automation recreates removed service identities)
• Automated permission restoration — privileges can be re-applied by scripts or workflows
(- scripts reassign permissions after removal)
Advanced Lateral Movement Risks (Enterprise)
• Identity-based remote management — trusted identities can be used to move internally
(- compromised identities are used for remote administration)
• SaaS-to-SaaS pivoting — connected platforms can become movement paths
(- integrations allow movement between SaaS platforms)
• Email-based lateral movement — shared mail access can open other systems
(- mailbox access exposes links and credentials)
• Collaboration workspace pivoting — shared spaces can expose more resources
(- shared workspaces reveal additional files and systems)
• Identity federation pivoting — trust between identity systems can be abused
(- federation trust allows movement between identity providers)
• Automation account pivoting — automation credentials can provide broad reach
(- automation accounts often have wide permissions)
Advanced Operational Stealth Risks
• Mimic admin maintenance activity — malicious actions can look like routine admin work
(- actions are disguised as normal maintenance tasks)
• Blend into change windows — attacks may happen during expected maintenance
(- activity occurs during scheduled change periods)
• Use legitimate automation — normal tools can hide suspicious activity
(- built-in automation tools execute malicious changes)
• Minimal privilege bursts — short elevated access can reduce detection chances
(- privileges are used briefly then removed)
• Silent permission checks — quiet access testing can avoid alarms
(- attackers test permissions without performing actions)
• Distributed activity timing — activity spread over time is harder to spot
(- operations are spread across long periods)
Long-Term Strategic Risk Objectives
• Executive monitoring — attackers may track leadership decisions over time
(- attackers monitor executive communications)
• Acquisition intelligence gathering — deal activity is a major target
(- merger and acquisition documents are targeted)
• Financial strategy observation — planning data can be monitored quietly
(- financial planning files are monitored)
• Product roadmap theft — future plans may be stolen before launch
(- roadmap documents reveal upcoming products)
• Competitive intelligence collection — internal strategy can be harvested gradually
(- strategy data is collected slowly)
• Persistent business espionage — long-term hidden access can support ongoing spying
(- attackers maintain access for intelligence gathering)
Advanced Tenant-Wide Control Risks
• Tenant configuration takeover — global settings can be changed across the environment
(- tenant-level configuration affects all users)
• Organization-wide sharing policy abuse — data can be exposed broadly
(- sharing policies allow wide external access)
• Global audit setting modification — monitoring visibility can be reduced centrally
(- audit settings changed reduce logging across tenant)
• Security baseline modification — default protections can be weakened
(- baseline policies are modified globally)
• Default permission manipulation — broad access can be granted silently
(- default permissions grant wide access)
• Organization relationship abuse — trust with external organizations can be exploited
(- cross-organization trust enables external access)
Advanced Identity Lifecycle Risks
• Account provisioning workflow abuse — creation processes can produce privileged accounts
(- onboarding workflows create accounts with elevated access)
• Deprovisioning bypass — removed users may remain active
(- disabled accounts retain access through sync or tokens)
• Rehire account restoration abuse — old access can return unexpectedly
(- reactivated accounts regain previous privileges)
• Guest invitation abuse — outsiders can become hidden backdoor users
(- guest accounts gain internal access)
• Identity attribute manipulation — account attributes can unlock extra privileges
(- modified attributes grant additional permissions)
• Automated account sync abuse — deleted users may be reintroduced automatically
(- directory synchronization recreates removed accounts)
Advanced Role & Permission Backdoor Risks
• Hidden role assignment inheritance — indirect admin rights may go unnoticed
(- inherited permissions grant elevated access without direct assignment)
• Scoped admin role abuse — limited admin roles can still be highly powerful
(- scoped roles still allow control over critical resources)
• Resource-level permission persistence — hidden access can remain on key resources
(- permissions remain directly assigned to specific resources)
• Role assignment via automation — scripts can auto-grant privileges
(- automation tools reassign roles automatically)
• Temporary role elevation persistence — scheduled admin access can quietly recur
(- time-based roles activate repeatedly)
• Privilege delegation loops — permissions can be designed to self-restore
(- delegated roles can recreate each other)
Advanced Enterprise Application Risks
• Enterprise app permission takeover — business applications can become access channels
(- applications with permissions can access organizational data)
• Consent grant persistence — API access may remain after initial approval
(- granted app permissions remain active long-term)
• Service principal privilege escalation — app identities can gain higher permissions
(- service principals receive elevated roles)
• App-to-app trust abuse — connected applications can extend access
(- trusted integrations allow lateral access)
• Automation workflow abuse — automated actions can be turned malicious
(- workflows execute unauthorized operations)
• Background job persistence — hidden scheduled execution can maintain access
(- scheduled jobs run repeatedly in background)
Advanced Monitoring & Audit Evasion Risks
• Audit log export disabling — backup logging can be stopped
(- export of logs to external storage is disabled)
• Log retention manipulation — investigation windows can be shortened
(- retention settings reduce available history)
• Alert notification rerouting — warnings can be hidden from admins
(- alert emails or notifications are redirected)
• Security dashboard manipulation — suspicious activity can be obscured
(- dashboards configured to hide anomalies)
• Event filtering abuse — attacker activity can be excluded from view
(- filters remove selected events from logs)
• Monitoring scope reduction — systems can be removed from monitoring coverage
(- monitoring configuration excludes resources)
Advanced Collaboration Platform Risks
• Team membership persistence — hidden group access can stay active
(- users remain in collaboration groups unnoticed)
• Shared workspace backdoors — collaboration spaces can provide long-term entry
(- shared workspaces grant ongoing access)
• File auto-sync abuse — continuous background data access can occur
(- sync clients download files automatically)
• Meeting recording extraction — sensitive recordings can be copied
(- recorded meetings can be downloaded)
• Chat export abuse — conversation history can be downloaded in bulk
(- chat export features allow large data retrieval)
• External collaboration persistence — outsider access can remain in place
(- external collaborators retain long-term access)
Advanced Data Harvesting Risks (Enterprise Scale)
• Organization-wide search abuse — built-in search can expose sensitive content
(- global search indexes locate sensitive files)
• Bulk file indexing — documents can be mapped at scale
(- file listings collected across repositories)
• Cross-project data discovery — multiple teams’ data can be collected
(- shared permissions allow access to various projects)
• Archive repository scraping — stored historical data can be accessed
(- archive storage contains older sensitive data)
• Knowledge base extraction — internal documentation can be stolen
(- documentation platforms expose procedures and secrets)
• Historical version harvesting — older file versions may leak sensitive details
(- version history reveals previous confidential content)
Advanced Operational Persistence Risks
• Multi-layer identity persistence — several identity backdoors can exist at once
(- multiple identity-based access methods remain active)
• Automated role restoration — privileges can be re-applied after removal
(- automation reassigns removed roles)
• Conditional access bypass persistence — hidden login paths can remain available
(- exceptions allow continued login)
• Service automation persistence — background jobs can preserve access
(- automation tasks recreate access)
• Cross-service persistence — access can survive across multiple platforms
(- integrated services preserve permissions)
• Redundant identity backdoors — fallback access methods make cleanup harder
(- multiple backup accounts exist)
Advanced Stealth Activity Risks
• Administrative action mimicry — malicious actions can resemble routine admin work
(- activity appears similar to normal administration)
• Scheduled maintenance window activity — activity during maintenance may be overlooked
(- operations occur during planned maintenance)
• Distributed privilege escalation — slow expansion of access is harder to detect
(- privileges increased gradually over time)
• Intermittent data access — small periodic access can avoid attention
(- data accessed in small intervals)
• Silent permission enumeration — rights can be checked quietly
(- permissions tested without making changes)
• Low-impact reconnaissance — minimal probing can stay below alert thresholds
(- reconnaissance performed slowly and lightly)
Strategic Long-Term Operational Risks
• Continuous intelligence gathering — attackers may collect information over long periods
(- information is gathered slowly over months to avoid detection)
• Long-term tenant access — persistent control of the environment is a major risk
(- long-lived access allows ongoing monitoring and control)
• Multi-phase data extraction — data theft may happen in stages
(- data is collected and exfiltrated gradually)
• Business decision monitoring — strategic choices can be observed in real time
(- attackers monitor communications and planning documents)
• Pre-positioned disruption capability — access may be held for later sabotage
(- attackers keep access ready for future disruption)
• Persistent enterprise espionage — ongoing hidden monitoring can continue for months
(- long-term surveillance without visible impact)
Advanced Identity Governance Risks
• Access review manipulation — approvals may be influenced to preserve access
(- access reviews are manipulated so permissions remain)
• Role approval workflow abuse — approvers can be tricked into granting roles
(- approval workflows are exploited to obtain privileges)
• Delegated approver compromise — compromised approvers can approve malicious requests
(- attacker-controlled approvers grant access)
• Just-in-time access abuse — temporary admin access can be requested repeatedly
(- temporary roles are repeatedly activated)
• Privileged access expiration bypass — elevated roles may not expire as intended
(- expiration settings are modified or bypassed)
• Access certification evasion — permissions can be hidden during reviews
(- roles are obscured during certification processes)
Advanced Privileged Access Management Risks
• Vault credential extraction — stored admin passwords may be stolen
(- credential vaults contain privileged passwords)
• Checkout workflow abuse — privileged credentials can be obtained improperly
(- checkout processes are abused to retrieve credentials)
• Session recording bypass — monitored admin sessions can be avoided
(- attackers avoid session recording mechanisms)
• Password rotation manipulation — critical passwords may stop changing
(- rotation policies are disabled or modified)
• Emergency credential abuse — break-glass accounts can be misused
(- emergency credentials grant high-level access)
• Privileged session hijacking — active admin sessions can be taken over
(- active privileged sessions are captured and reused)
Advanced Automation Risks
• Scheduled automation persistence — recurring tasks can maintain hidden access
(- scheduled automation recreates permissions)
• Runbook manipulation — automated workflows can be changed for malicious purposes
(- runbooks modified to execute unauthorized actions)
• CI automation credential theft — pipeline secrets are high-value targets
(- CI/CD pipelines store credentials and tokens)
• Deployment pipeline persistence — malicious code can remain in release processes
(- deployment workflows distribute malicious changes)
• Infrastructure automation abuse — systems can be changed silently at scale
(- infrastructure automation applies changes widely)
• Background job privilege escalation — automated jobs can execute with high privileges
(- background jobs run with elevated permissions)
Advanced Cross-Service Movement Risks
• Identity token reuse across services — one login can open several systems
(- authentication tokens work across multiple services)
• Shared API permission pivot — connected platforms can extend access
(- shared API permissions allow cross-platform access)
• Unified directory pivoting — shared identity systems can bridge environments
(- unified directories connect multiple services)
• Email-to-cloud pivot — mailbox access can lead into cloud services
(- email access reveals links and credentials)
• File-sharing platform pivot — shared documents can expose new resources
(- shared file platforms reveal additional access)
• Collaboration tool pivot — team workspaces can become movement paths
(- collaboration tools connect multiple systems)
Advanced Data Intelligence Collection Risks
• Business strategy document targeting — strategic files are prime targets
(- strategy documents contain sensitive planning)
• Executive calendar monitoring — leadership schedules can reveal sensitive activity
(- calendars reveal meetings and initiatives)
• Merger and acquisition data targeting — deal information is especially valuable
(- M&A documents contain confidential negotiations)
• Financial planning document extraction — forecasts can be exposed
(- financial plans reveal future direction)
• Internal audit report extraction — security weaknesses may be discovered
(- audit reports list vulnerabilities)
• Product development documentation theft — technical designs can be stolen
(- development documentation contains intellectual property)
Advanced Persistence Risks (Policy-Based)
• Policy exception persistence — whitelist rules can preserve hidden access
(- policy exceptions allow continued access)
• Conditional rule manipulation — attacker-friendly conditions can be added
(- conditions modified to allow login)
• Security policy inheritance abuse — hidden permission flow can persist through policy logic
(- inherited policy rules grant unintended access)
• Access policy shadow entries — hard-to-see rules can grant access
(- obscure policy entries allow access)
• Automated policy reapplication — deleted rules can come back automatically
(- automation restores removed policies)
• Multi-policy persistence — several overlapping rule backdoors can exist
(- multiple policies combine to maintain access)
Advanced Detection Avoidance Risks
• Change window activity blending — attacks may be timed with planned changes
(- activity occurs during maintenance windows to appear legitimate)
• Admin tool activity mimicry — normal admin tools can conceal malicious actions
(- standard administrative tools are used to hide malicious changes)
• Low-volume administrative actions — small changes can stay below thresholds
(- minimal changes reduce alert likelihood)
• Rotating privilege usage — varied methods can avoid detection patterns
(- different accounts or roles are used to avoid patterns)
• Delayed administrative execution — waiting can reduce suspicion
(- actions executed after long delays)
• Gradual permission expansion — slow escalation is harder to notice
(- privileges increase incrementally over time)
Advanced Lateral Movement Risks (Platform-Based)
• Admin portal pivoting — admin consoles can become movement points
(- administrative portals provide access to multiple services)
• Management API pivoting — APIs can extend access programmatically
(- management APIs allow automated cross-service access)
• Directory sync pivoting — sync systems can bridge identity environments
(- directory synchronization connects environments)
• Automation account pivoting — workflow identities can move across services
(- automation identities have broad access)
• Shared tenant service pivoting — shared services can expose new paths
(- shared tenant services connect multiple systems)
• Monitoring tool pivoting — monitoring platforms can provide broad reach
(- monitoring tools often access many resources)
Advanced Operational Control Risks
• Multi-layer administrative backdoors — several admin paths can remain hidden
(- multiple administrative access paths exist simultaneously)
• Distributed permission placement — access spread across services is hard to remove
(- permissions assigned across many systems)
• Redundant automation persistence — multiple workflows can restore access
(- automation recreates permissions from several sources)
• Cross-platform persistence — presence can survive across several systems
(- access maintained in multiple platforms)
• Identity rehydration persistence — deleted identities may return
(- synchronization restores removed accounts)
• Long-duration access scheduling — admin access can be timed for later use
(- scheduled privileges activate in the future)
Strategic Long-Term Risk Objectives
• Competitive intelligence monitoring — business strategy can be observed over time
(- strategic documents and communications are monitored)
• Financial event observation — sensitive financial actions can be tracked
(- financial activity monitored quietly)
• Executive communication monitoring — leadership messages may be watched continuously
(- executive emails and chats observed)
• Long-term data accumulation — data can be gathered gradually to avoid notice
(- information collected slowly)
• Pre-positioned disruption capability — access may be kept for future attacks
(- access retained for later impact)
• Persistent enterprise observation — hidden long-term monitoring is a major risk
(- ongoing surveillance without detection)
Advanced Identity Architecture Risks
• Directory schema abuse — identity structure rules can be altered
(- schema modifications change privilege logic)
• Identity attribute privilege escalation — hidden access can come from account attributes
(- attributes grant additional permissions)
• Dynamic group rule abuse — rule logic can place users into privileged groups
(- dynamic group conditions add users automatically)
• Identity lifecycle trigger abuse — automatic processes can grant access unexpectedly
(- lifecycle workflows assign permissions)
• Hybrid identity mapping abuse — synced identities can be manipulated
(- hybrid identity mapping grants unintended access)
• Privilege via attribute injection — user fields can be abused to gain access
(- modified attributes trigger privileged assignments)
Advanced Federation Risks
• Federation metadata manipulation — trusted identity settings can be altered
(- federation configuration modified to allow access)
• Token issuer spoofing — fake trusted tokens can appear valid
(- forged token issuer appears trusted)
• Federation trust persistence — hidden external login trust can remain active
(- federation trust provides ongoing external access)
• Claims rule manipulation — authorization logic can be quietly changed
(- claims rules altered to grant privileges)
• SAML token replay — previously valid tokens may be reused
(- captured SAML tokens reused for login)
• Identity provider failover abuse — fallback identity paths can become attack routes
(- failover identity providers allow alternate access)