Glossary of identity and cloud attacks

Short, accurate definitions of the attacks and concepts behind Range scenarios. For deeper writeups, see the blog.

Identity and Active Directory

• DCSync: abusing directory replication rights to pull password hashes, including krbtgt, from a domain controller as if you were one.
• Kerberoasting: requesting service tickets for accounts with a service principal name and cracking them offline to recover the service account password.
• AS-REP roasting: harvesting crackable material for accounts that have Kerberos pre-authentication disabled, with no credentials needed.
• Golden Ticket: a Kerberos ticket forged with the krbtgt hash that authenticates as any user, used for domain persistence.
• Pass-the-Hash and Pass-the-Ticket: authenticating with a stolen NTLM hash or Kerberos ticket instead of a password, to move laterally.
• Kerberos delegation abuse: misconfigured delegation that lets a compromised host impersonate arbitrary users, up to domain admin.
• NTLM relay: capturing and forwarding NTLM authentication to a service to act as the victim, including against AD CS (ESC8).
• AD CS ESC1 and ESC8: certificate-services misconfigurations that let an attacker obtain certificates impersonating privileged accounts.
• Zerologon: CVE-2020-1472, a Netlogon flaw that let an unauthenticated attacker take over a domain controller.

Entra ID, Microsoft 365, and Azure

• Device code phishing: tricking a user into completing a legitimate device-code sign-in that authorizes the attacker.
• MFA fatigue: flooding a user with push prompts until they approve one.
• OAuth consent and app abuse: getting a malicious or over-permissioned application authorized to act with its own token.
• Primary Refresh Token theft: stealing the Windows device token that grants Entra single sign-on, with the MFA claim already satisfied.
• Conditional Access bypass: reaching a resource through a gap in policy, such as legacy authentication or an excluded account.
• Golden SAML: forging federation tokens with a stolen identity-provider signing key, bypassing MFA across federated apps.
• Service principal credential persistence: adding a secret or certificate to an app to keep app-only access that survives password resets.
• Azure RBAC escalation: using role-assignment rights to grant yourself higher privilege, up to subscription Owner.
• Managed identity abuse: requesting an Azure resource platform-issued token from a host you compromised, inheriting its roles.

AWS, GCP, and SaaS

• SSRF to cloud credentials: abusing a server-side request flaw to read instance role credentials from the metadata service.
• IAM privilege escalation: chaining IAM permissions, often iam:PassRole, to reach administrative access.
• S3 exposure: data loss through public buckets, over-broad policies, or stolen read-capable credentials.
• Leaked access key: a static long-term key committed to code or images, scraped and abused within minutes.
• CloudTrail tampering: disabling or filtering logging to blind detection and break forensics.
• GCP service account impersonation: minting tokens for a service account you can impersonate, inheriting its roles without a key.
• Okta support HAR session theft: extracting a live session token from an uploaded HAR file and replaying an admin session.
• Snowflake stolen-credential theft: using valid stolen credentials against SaaS accounts that lack MFA to bulk-export data.

Response concepts

• Blast radius: the full set of identities, systems, and data an attacker can reach from a given foothold.
• Tier 0: the most privileged assets and identities, whose compromise means the attacker owns the environment.
• Containment: stopping the attacker current access without necessarily removing them yet.
• Eradication: removing the attacker access and persistence so they cannot return.
• Dual extortion: ransomware that both encrypts systems and threatens to leak stolen data.