Detecting Credential Abuse

The talk opens with why attackers want credentials. Account compromise can fuel spam, fraud or ransomware, or give an intruder an initial foothold, a path for lateral movement, or a route to privilege escalation. The presenters treat credentials both as proof of identity and as keys to access, and note that stronger authentication and tighter binding to a device make a credential more trustworthy. They stress that good logging comes first, since detections are only as reliable as the data behind them.

The core of the session covers detection patterns at identity providers. Impossible travel flags sign-ins whose implied travel speed is unrealistic, but IP geolocation is noisy because of VPNs and shifting address blocks, so they recommend combining indicators across log sources and weighting each by how portable the credential is. Credential binding checks compare a device, TLS channel, IP range or time window against where a credential was issued, and a failed check is logged as a violation. For forged credentials, a usage event with no matching creation event suggests the credential was minted out of band. Credential sharing and sale are harder to handle because the user may be complicit.

The response section stresses establishing scope, whether the credential still works, and what the attacker did afterward. Investigators should test hypotheses rather than assume intent, and keep the affected user in mind when forcing logouts or reauthentication. Trade-offs include log volume, alert fatigue and the friction that controls add. Detection at the identity provider, layered with controls, is presented as more practical than chasing every possible theft method.