The Intrusion That Brings No Malware

The part of the attack chain that stopped needing malware

Multi-factor authentication did what it was supposed to do. It made the password, on its own, close to worthless. What followed was not a defeat of that control so much as a decision to stop attacking it: if the password is no longer the thing worth stealing, steal the thing authentication produces instead.

That thing is a session. A browser cookie, a refresh token, an application access token, a device registration. It is the receipt the identity provider issues once it is satisfied, and it is designed to be replayed, because replaying it is what keeps a user from logging in forty times a day. An attacker holding one does not need the password and does not need the second factor, because both have already been presented.

MITRE ATT&CK has carried names for this for years. T1539 is the theft of a web session cookie. T1550 is the use of alternate authentication material. T1621 is the generation of repeated multi-factor prompts until somebody approves one. T1098 covers the manipulation of the account afterwards, including the registration of a new device. None of those techniques requires a file to be written to disk.

Why a rule engine has nothing to match

Detection content is written against two kinds of thing. The first is failure: a burst of denied logins, a blocked access, a privilege request that was refused. The second is known-bad: a hash, a domain, a command line, a signature somebody wrote down after seeing it before.

A replayed session produces neither. It produces success, from a valid account, using an approved method, against a system the account is entitled to reach. There is no failure to count and no indicator to match, so the rule that was supposed to catch this never fires, and the absence of an alert is read as the absence of a problem.

What does get generated is a long trail of individually unremarkable events. That trail is the detection opportunity and also the reason it is usually missed, because reading it requires holding several hundred ordinary events in mind at once and noticing that together they describe something nobody would do.

• A successful sign-in, which the environment produces thousands of times a day.
• A directory read, which any employee is permitted to perform.
• A new authenticator registered, which is what happens every time somebody changes their phone.
• A mailbox rule created, which users create for themselves constantly.
• A file opened in a repository the account has always been able to open.

Impossible travel is the crude version of a correct idea

The instinct behind impossible travel is right: compare what happened against what normally happens for this account. The implementation is thin, because it compares one dimension, geography, inferred from an address that a corporate VPN, a mobile network or a cloud egress point will misreport several times a week.

The result is a detection that produces false positives for every travelling executive and produces nothing at all for an attacker operating from the same city, the same country or the same cloud region. A control that is noisy against your own staff and quiet against your adversary is worse than no control, because it trains the shift to dismiss the category.

The dimensions that actually separate a compromised session from its owner are less convenient and more durable: what this account's role normally reaches, the hours it has kept for months, whether the device has been seen before, which systems it touched and in what order, and above all what the session did once it was inside. Entry is the least interesting part of an identity intrusion. Behaviour after entry is where it declares itself.

The investigation is the expensive part, again

Suppose the alert does fire. Answering it requires evidence from four places at once: the identity provider, the endpoint the session claims to be running on, the cloud and SaaS applications the session reached, and the network path it took. No one of those four can answer the question on its own, which is why an identity investigation is among the most console-intensive work an analyst does.

Done by hand it runs 60 to 90 minutes across five to twelve consoles, and it has to be done against a queue of more than eleven thousand alerts a day arriving into an average operation. The arithmetic decides the outcome before anybody reaches the ticket: most identity alerts are not investigated badly, they are investigated late.

Late is the problem, because the other clock is short. Average breakout time for a criminal intrusion is 29 minutes, down from 98 minutes in 2021, and access changes hands between criminal specialists in a median of 22 seconds. An alert that waits an hour is not describing a situation that is still developing. It is describing one that has already moved.

What the hour looks like from the other side

The sequence is worth reading as a defender rather than as an incident report, because the uncomfortable detail is that every step in it succeeds and none of it is unusual in isolation.

Note in particular where the attacker stops depending on the stolen session. Once a second factor is registered against the account, revoking the original token achieves nothing: there is now an independent way in, obtained through a legitimate self-service flow that the organisation deliberately built to be easy.

That is the window the investigation is racing. Not the moment of entry, which is already past, but the moment persistence is established, after which containment becomes a far larger piece of work.

Containment for an identity is not containment for a host

The response actions that an endpoint-shaped process reaches for do not fit. Isolating the laptop does not end a cloud session created from a cookie that is now being replayed from somewhere else entirely. Resetting the password does not invalidate a refresh token that was issued before the reset. Disabling the account does not remove an application consent that an attacker granted to a third-party integration while they had control of it.

Each of those is a different object with a different lifetime, and a containment that handles one and leaves the others is the kind of partial action that reads as closure in a ticket and is not closure in the environment.

This is also why the verdict matters more than the alert. Mass session revocation across a tenant is disruptive enough that nobody does it on suspicion, so the action waits on somebody being confident. Confidence is produced by investigation, which brings the cost back to the same interval that everything else in this argument comes back to.

• Revoke sessions and refresh tokens, not only the password.
• Enumerate and remove authenticators, device registrations and application consents added during the window.
• Check for mailbox rules and forwarding created while the session was live.
• Re-enrol the human through a verified path, because every factor on the account is now of unknown provenance.

What an autonomous investigation does with an identity alert

The distinction worth insisting on is between a system that summarises an identity alert and a system that investigates one. Summarisation reads the alert and writes a paragraph about it. The paragraph is fluent, and the analyst still has to open the four consoles to find out whether the thing described actually happened.

An autonomous investigation performs the pivot instead. It gathers the account's own history and its peers', pulls the endpoint state for the device the session claims to be on, retrieves what the session reached in cloud and SaaS, reconstructs the order those things happened in, tests the obvious innocent explanations, and returns a verdict with the evidence attached rather than a confidence score with a prompt attached.

Run that way, the work takes 60 to 120 seconds instead of 60 to 90 minutes, and it runs on every qualified identity alert rather than on the ones a person reached before the shift ended. The change is not that the analyst reads faster. It is that the analyst receives a finished investigation and spends their judgement on the decision, which is the part that was always worth a person.

What to measure, and what to stop measuring

Most identity security reporting measures coverage, because coverage is easy to count. The proportion of accounts with multi-factor enabled is a useful number and it is not a measure of detection, since every technique described here operates on accounts that have it.

The numbers that describe whether an operation can actually handle this category are about time and completeness. How long from an identity alert to a decision. What proportion of identity alerts received a full cross-domain investigation rather than a glance at the sign-in log. How long from the decision to sessions actually being revoked. How many of these closed without a human, and how many of those closures were later found to be wrong.

A programme that cannot answer those four questions is not measuring its exposure to this. It is measuring its enrolment.

• Time from identity alert to verdict, not to acknowledgement.
• Proportion of identity alerts that received evidence from identity, endpoint, cloud and network rather than one of the four.
• Time from verdict to session revocation, which is a different number and usually a worse one.
• Rate of autonomous closure, and the rate at which those closures were later reopened.

The uncomfortable summary

Identity became the primary route in because the defences around it worked. Strong authentication raised the cost of the front door enough that attackers started walking in with a receipt instead, and the receipt is honoured by design.

What follows is not an argument for weakening those controls or for adding another one beside them. It is an argument that the detection for this category cannot be written as rules, because there is nothing that fails, and cannot be resolved by summarisation, because the expensive part is the pivot rather than the prose.

It has to be an investigation, it has to span four domains at once, and it has to complete inside a window that is now measured in minutes. That is a capacity problem, and capacity is the one thing a longer rule set has never produced.