A comprehensive catalog of 40+ real-world identity-centric attacker behaviors observed across nation-state APT groups, ransomware operators, insider threats, cloud-native adversaries, and hybrid intrusion teams.
Understanding Modern Identity Attacks
What IBP Delivers
The Identity Breach Patterns Library consolidates the most common identity-focused attack behaviors into a unified reference. This library helps security and identity teams understand what attackers do, which weaknesses they exploit, and which detection signals reveal them before privilege escalation or persistence occurs.
Each pattern maps directly to the Identity Attack Chain (IAC), showing where behaviors fit in the attack lifecycle and which threat actors actively use each technique.
Strategic Purpose
Enable early recognition of identity attacks by providing security teams, threat hunters, and identity engineers with actionable intelligence. The library bridges the gap between abstract threat models and concrete attacker tradecraft, offering detection logic, prerequisites, and misconfigurations for each pattern.
Focus on preventing lateral movement and privilege escalation by identifying indicators during reconnaissance and initial access phases.
Breach Pattern Categories
Nine distinct categories organize 40+ breach patterns (BP-001 → BP-049), each representing a critical phase of identity-centric attacks. Navigate to any category to explore detailed patterns with detection signals, threat actor associations, and Identity Attack Chain mappings.
Reconnaissance & Enumeration
Domain scanning, user harvesting, identity surface discovery
Every Breach Pattern page follows a consistent, comprehensive structure designed for rapid threat analysis and detection engineering. Each pattern provides clear descriptions of attacker techniques, prerequisites and enabling conditions, misconfigurations that enable the behavior, and detection logic signals.
Patterns map to the Identity Attack Chain (IAC), include threat actor associations, provide executive storyline linkages, and feature text-based identity graph annotations for visual context. Clean navigation allows movement across the entire library.