Compromising Identity Provider Federation

Originally published by CrowdStrike. CrowdStrike’s Incident Response team has seen a recent increase in cases involving adversaries that abuse identity provider federation to gain access to protected services by adding and authorizing rogue domains to federation. From these cases, patterns have emerged that indicate a common attack structure.Monitoring for identity provider abuse can be difficult, given that adversaries do so by leveraging legitimate cloud services, often using compromised ac...

abuse access adversaries attack cases crowdstrike domains federation identity identity provider incident incident response incident response team monitoring patterns response rogue services structure team