Advanced detection logic for post-authentication identity threats, covering token replay, federation manipulation, session hijacking, and persistent access attacks that bypass traditional authentication controls.
What This Category Represents
Category B unifies the core detection logic used to identify sophisticated identity attacks that occur after authentication succeeds. These signals detect token replay, token theft, federation manipulation, SAML/OIDC trust abuse, session hijacking, STS misuse, audience/scope manipulation, and refresh-token-based persistence.
Traditional login-focused security controls fail to detect these attacks because they operate in the post-authentication phase. This category covers the majority of identity-centric advanced intrusions observed in modern cloud and SaaS environments.
Critical Insight
Token abuse is the #1 identity persistence technique, ahead of malware. Most cloud/SaaS intrusions hinge on token behavior, not login failures. Identity cannot be secured unless token behavior is monitored holistically.
Core Detection Signals: Token Replay & Theft
Token Used from New IP With Old Device Fingerprint
Strong replay indicator when the same device fingerprint appears from a different IP address, suggesting token extraction and reuse from a compromised session.
Refresh Token Used Immediately After Password Reset
Critical sign of token-based persistence (BP-027). Attackers maintain access through refresh tokens even after credential changes, bypassing password reset defenses.
Token Replay Across Multiple Sessions
Same token ID used in parallel across different regions or networks, indicating token duplication and concurrent unauthorized access attempts.
Token Used With Non-Compliant Browser/Agent
Legitimate token replayed through automation tools, headless browsers, or custom scripts, revealing replay attacks via non-standard user agents.
Access Token Used Outside Normal Behavioral Profile
Human identity token performing machine operations or exhibiting automated behavior patterns. This is a strong compromise indicator requiring immediate investigation.
Federation & Trust Manipulation Signals
Token Audience Mismatch
Token's aud claim doesn't match expected resource, common in OAuth abuse or weak STS validation scenarios.
Signing Key or Certificate Mismatch
Token signed by unexpected key/issuer, indicating SAML/OIDC trust attack (BP-018) or compromised federation infrastructure.
Suspicious Use of Token Exchange (On-Behalf-Of Flows)
Abnormal delegation patterns suggesting machine identity impersonation or service account compromise.
Token Lifetime Mismatch (Abnormally Long)
Token validity period exceeds organizational policy, often due to legacy configuration or deliberate token abuse.
Federation Anomalies
Federation anomalies remain invisible unless claims, audience, and issuer validation are continuously monitored. Weak federation trust is exploited in over 60% of advanced identity attacks.
Identity Attack Chain Alignment
These detection signals map directly to critical stages of the Identity Attack Chain, providing coverage across post-authentication phases where traditional controls fail.