Glossary

Identity and cloud attack glossary

Plain-language definitions of the identity-based attacks teams face, and the ones GraphLattice Range trains you to detect and respond to.

Kerberoasting

An attack that requests Kerberos service tickets for accounts with a Service Principal Name, then cracks them offline to recover the service account password. It needs only a normal domain user and leaves little trace, so weak service-account passwords are a common path to privilege escalation in Active Directory.

AS-REP Roasting

An attack against Active Directory accounts that have Kerberos pre-authentication disabled. The attacker requests an AS-REP for such an account and cracks the returned encrypted material offline to recover the password, with no prior access to the account.

DCSync

An attack in which a principal with directory-replication rights asks a domain controller to replicate account secrets, including password hashes for any user, as if it were another domain controller. It extracts the krbtgt hash and other credentials without touching a domain controller disk.

Golden Ticket

A forged Kerberos ticket-granting ticket created with the domain krbtgt account hash. Because it is signed with the krbtgt key, it grants access as any user and survives password resets of the impersonated accounts, so it is removed only by rotating krbtgt twice.

Golden SAML

A federation attack in which an attacker who has stolen an identity provider token-signing key, for example an AD FS certificate, forges SAML authentication tokens for any user and any federated application, bypassing passwords and MFA entirely.

Pass-the-Hash

A technique that authenticates using an account NTLM password hash directly, without the plaintext password. An attacker who captures a hash can move laterally as that account wherever NTLM authentication is accepted.

Pass-the-Ticket

A technique that reuses a stolen Kerberos ticket, a ticket-granting ticket or service ticket, to authenticate as the ticket owner without the account password. It is a common lateral-movement step after credential theft from memory.

AdminSDHolder abuse

Abuse of the AdminSDHolder object in Active Directory, whose ACL the SDProp process periodically stamps onto protected privileged accounts. An attacker who edits that ACL gains durable rights over Domain Admins and other protected groups that reappear even after cleanup.

AD CS ESC8

An Active Directory Certificate Services attack that relays NTLM authentication to a certificate authority web enrollment endpoint to obtain a certificate for the victim, then uses that certificate to authenticate. It is one of several ADCS escalation paths that arise from misconfigured templates or CA settings.

Device code phishing

A phishing technique that abuses the OAuth device-authorization flow. The attacker starts a device-code login and gets a user to approve it on the real Microsoft page, capturing access and refresh tokens with no fake site, no password, and no MFA prompt of the attacker own.

Primary Refresh Token theft

Theft of the Primary Refresh Token, a long-lived token issued to a device joined to Entra ID that silently obtains access tokens for the user. Stealing a PRT lets an attacker impersonate the user across Microsoft cloud services without their password or MFA.

OAuth consent phishing

Also called an illicit consent grant. A user is tricked into granting a malicious OAuth application broad permissions to their account, and the app then reads mail, files, or data using its own token, with no password to reset and access that persists until the consent is revoked.

Service principal credential abuse

Abuse of a cloud application identity. An attacker adds a secret or certificate to an app registration or service principal, then authenticates as that app to reach the data and resources it is entitled to, a persistence path a user password reset does not affect.

Managed identity abuse

Abuse of a cloud workload managed identity by executing code on the workload, for example through a VM run-command, and requesting the identity token from the instance metadata service, then using that token against the cloud resources the identity is authorized for.

Cloud privilege escalation

Escalation in a cloud IAM model where a principal with the right to pass or assign a role grants itself or a workload a more powerful role, turning a narrow permission into broad control of the account or subscription.

Service account takeover

Compromise of a non-human account used by an application or automation. Because service accounts often hold standing broad privileges and weak or unrotated credentials, taking one over frequently yields durable, high-privilege access.