Emulating the Identity First Threat Actor - Automated Playbooks for IdP Hijacking

The talk starts from the shift in how intrusions begin: attackers often log in with valid identities instead of deploying malware, so endpoint-focused emulation misses much of the activity. The speakers describe an identity-first kill chain with six phases, running from initial access and persistence through discovery, privilege escalation and trust manipulation, ending with pivots into SaaS or cloud. Each step is written as a detection contract that names the expected identity-provider or cloud log, a detection hypothesis, typical failure points, and the evidence that shows a control worked.

The middle section covers scoring. Playbooks are rated on a five-level scale, from blind (no telemetry) through event-only and huntable, up to level three, where an alert fires on time with usable fidelity. Three examples were walked through: a device code sign-in approved by a user, illicit consent to a broad-scope application as persistence that survives password resets, and federated role assumption into cloud accounts through overly wide trust policies. All runs used synthetic identities in a mocked environment. The pre-generated lab output showed early identity steps at the blind level, with stronger coverage only where ownership was mature.

The takeaway is to build a coverage heat map, fix the weakest entry and exit points first, such as phishing-resistant MFA, token protection and device code restrictions, and then rerun the playbooks to confirm the scores improve. The speakers said the open-source tool and demo would be shared after the session.