Identity Systems & Protocols
Deep dives into AD, Entra ID, Okta, AWS IAM, Google Workspace, Linux PAM, RADIUS/TACACS+, and PKI — architecture, trust boundaries, and telemetry each system emits.
Open →What This Is
A practitioner handbook covering the full ITDR chain: understand the identity protocols, build lab environments, learn the attack primitives (with real-world CTI examples and threat actor usage), write detection logic to the required telemetry and DRL standard, then simulate full attack–defense scenarios to validate coverage.
Identity is the primary attack surface in modern enterprise. This project treats each identity system as a protocol to be fully understood — not just configured — before discussing how it is abused and how that abuse is detected.
Six Phases
Lab Environments
Hands-on lab builds for each identity system. Prerequisites, Vagrant/Docker configs, validation steps, and baseline snapshots for attack simulation.
Open →Attack Techniques
ATT&CK-mapped attacks per identity system. Each entry includes the technical primitive, CTI examples with evidence labels, real-world actor usage, and behavioral indicators.
Open →Detection Engineering
Per-attack detection pages with required telemetry (Event IDs, API logs), Sigma rules, KQL (Sentinel/MDE), SPL (Splunk), DRL levels, and false-positive handling.
Open →Attack–Defense Simulations
End-to-end scenarios that tie labs, attacks, and detection together. Full attacker TTP sequence, defender monitoring checklist, expected triggers, and after-action review.
Open →Identity Foundations
Identity as the new perimeter, authentication vs authorization, principal taxonomy, Zero Trust model, and key identity frameworks (NIST, MITRE ATT&CK IAM, CIS Controls).
Open →Identity Systems Coverage
Active Directory
Kerberos · NTLM · LDAP · GPO · Trusts · ADCS
Entra ID
OAuth2 · OIDC · SAML · Conditional Access · PIM
Okta
SAML · SCIM · MFA · Policies
AWS IAM
IAM · STS · Cognito · Role Chaining
Google Workspace
SAML · OIDC · Cloud Identity
Linux Identity
PAM · SSSD · Kerberos · sudo
RADIUS / TACACS+
Network Authentication · NAC
PKI & Certificates
X.509 · ADCS · ESC chains · Smart Cards
Attack Coverage
Active Directory: Kerberoasting · AS-REP Roasting · Pass-the-Hash · Pass-the-Ticket · Golden Ticket · Silver Ticket · DCSync · ACL Abuse · Skeleton Key · SID History Abuse
Cloud / Entra ID: Device Code Phishing · Illicit Consent Grant · MFA Fatigue / Push Bombing · OAuth Token Theft · Pass-the-PRT · Golden SAML
ADCS / Certificates: ESC1–ESC8 template abuse · CA key compromise · Certificate theft
Cross-Platform: Hybrid attack chains (on-prem → cloud) · Credential stuffing · MFA bypass
Detection Standard
Detection pages use the same DRL (Detection Readiness Level) model from the CTI Analyst Field Manual. Each page specifies required telemetry, a Sigma rule, KQL for Microsoft Sentinel / MDE, SPL for Splunk, and an explicit DRL level. Only DRL-9 is marked production-ready. False-positive handling is required for every rule.
Defensive Use
All content is public, defensive, and TLP:CLEAR oriented. Attack techniques are documented at the behavioral level needed for detection engineering and threat intelligence. This project excludes working exploits, credential dumps, victim-sensitive data, and operational instructions for unauthorized access.