Compromising Identity Provider Federation

CrowdStrike’s Incident Response team has seen a recent increase in cases involving adversaries that abuse identity provider federation to gain access to protected services by adding and authorizing rogue domains to federation. From these cases, patterns have emerged that indicate a common attack structure. Monitoring for identity provider abuse can be difficult, given that adversaries […]

abuse access adversaries attack cases cloud security crowdstrike domains featured federation identity identity provider incident incident response incident response team monitoring patterns response rogue services structure team