Between May and July 2026, Prophet Security investigated every alert across its customer environments — not a sampled subset, not a triaged shortlist, but the full alert stream. The findings, published this week, carry a message every CISO and SOC lead needs to internalize: identity was the target in roughly half of all confirmed malicious activity.
That statistic should not surprise anyone who has run an IR engagement in the last eighteen months, but seeing it confirmed at scale — across a full quarter of complete alert coverage — removes any remaining ambiguity. The perimeter is no longer the firewall. It is the identity provider. Attackers have largely stopped burning zero-days when a phished session token, a fatigued MFA prompt, or a malicious OAuth consent grant gets them through the front door with legitimate credentials.
This post breaks down the four dominant attack patterns observed in the dataset, explains why some attacks succeeded while others were blocked, and gives you the detection logic and hardening steps to move your environment from the first column to the second.
Technical Analysis: The Four Dominant Attack Patterns
The report's core finding is that confirmed malicious activity clustered into four repeatable patterns, with identity-based techniques dominating. Based on the published analysis, the patterns are:
1. Adversary-in-the-Middle (AiTM) Phishing and Session Token Theft
The most consequential identity pattern in the dataset. Attackers deploy reverse-proxy phishing kits (Evilginx-style frameworks and their commercial successors) that sit between the victim and the legitimate identity provider. The victim completes real authentication — including MFA — on the real Microsoft Entra ID or Okta page, but the proxy captures the resulting session cookie.
Why it matters: the attacker does not need the password or the MFA method afterward. They replay the stolen session token from their own infrastructure, satisfying conditional access policies that check for "MFA completed" because, from the IdP's perspective, MFA was completed. The telltale signs in telemetry are session reuse from a new IP/ASN, a new device fingerprint, or a geographically implausible location shortly after a successful interactive sign-in.
2. MFA Fatigue (Push Bombing) and Social-Engineered Approval
The second identity pattern: attackers holding valid credentials (purchased from infostealer logs, breached credential dumps, or password spraying) hammer the victim with push notifications until one is approved — or call the help desk / the user directly and talk them into approving. The report's quarter showed this remains effective precisely because it exploits process weakness, not a software bug.
Why some organizations blocked it and others didn't came down to two controls: number matching (which forces the user to type a code shown on the login screen, making blind approval impossible) and help-desk identity verification rigor. Environments relying on simple approve/deny push were compromised; environments with number matching enforced and phishing-resistant MFA (FIDO2/passkeys) on privileged accounts were not.
3. Malicious OAuth Applications and Consent Phishing
Rather than stealing credentials, attackers trick a user into granting an OAuth application permissions — typically mail read/write, offline access, and directory read. The application then operates with delegated permissions that survive password resets and, in many configurations, are invisible to traditional AV/EDR. This pattern is how attackers maintain durable mailbox access for business email compromise staging even after the initial phish is discovered and the password rotated.
4. Password Spraying and Legacy Authentication Abuse
The fourth pattern is the oldest and still productive: low-and-slow password spraying against cloud tenants, frequently routed through residential proxy networks to defeat IP-based blocking, and disproportionately targeting endpoints that still allow legacy authentication protocols (IMAP, POP, SMTP AUTH, older Exchange ActiveSync) that do not support modern conditional access enforcement. One sprayed credential against a legacy-auth-enabled mailbox is often the initial foothold that feeds patterns 1–3.
Exploitation Status
These are not theoretical techniques. All four patterns represent confirmed malicious activity observed in production customer environments during the May–July 2026 window — not honeypot data, not red team exercises. There is no associated CVE because there is no patch: these are architectural and process weaknesses in how identity is configured and monitored, not vendor software defects. No CISA KEV entry applies; the remediation is configuration, detection, and process — which is exactly why it gets deferred, and exactly why attackers keep using it.
Detection & Response
The detections below target the observable behaviors of these four patterns. They are written to be deployed as-is in a mature environment, but tune thresholds to your baseline before promoting to high-severity alerting.
Sigma Rules
---
title: Entra ID Sign-In from Multiple Countries Within Short Window (Impossible Travel / Token Replay)
id: 8f2c1a44-3b7e-4d91-a6c2-9e5f7b1d2048
status: experimental
description: Detects a single user with successful sign-ins from two or more distinct countries within a 60-minute window, indicative of AiTM session token replay or credential use from attacker infrastructure.
references:
- https://attack.mitre.org/techniques/T1557/
- https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/08/14
tags:
- attack.credential_access
- attack.t1557
- attack.t1539
logsource:
product: azure
category: signin
detection:
selection:
status.errorCode: 0
condition: selection
falsepositives:
- Users on VPN or corporate egress in foreign countries
- Mobile users crossing borders
level: high
---
title: High Volume of MFA Push Denials or Failures Followed by Success (MFA Fatigue)
id: 2d6b9e17-8c4f-4a35-b9d1-6f3e8a2c5197
status: experimental
description: Detects repeated MFA denials or authentication failures for a single user followed by a successful authentication, consistent with MFA push bombing until approval.
references:
- https://attack.mitre.org/techniques/T1621/
author: Security Arsenal
date: 2026/08/14
tags:
- attack.credential_access
- attack.t1621
logsource:
product: azure
category: signin
detection:
selection_fail:
status.errorCode:
- 500121 # MFA authentication failed
- 50074 # MFA required / strong auth failed
- 50126 # Invalid username or password
timeframe: 30m
condition: selection_fail | count() by userPrincipalName > 5
falsepositives:
- Users with expired credentials repeatedly retrying
- Misconfigured mobile mail clients
level: high
---
title: Suspicious OAuth Application Consent Grant with Mail or Offline Access
id: 4a1e7c93-5d28-4f6b-9a34-7c2d5e8b1063
status: experimental
description: Detects user consent granted to an OAuth application requesting high-risk scopes such as Mail.Read, Mail.ReadWrite, Mail.Send, offline_access, or full directory read, consistent with consent phishing.
references:
- https://attack.mitre.org/techniques/T1550.001/
- https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/08/14
tags:
- attack.persistence
- attack.credential_access
- attack.t1550.001
logsource:
product: azure
category: auditlogs
detection:
selection:
operationName: 'Consent to application'
filter_high_risk_scopes:
targetResources|contains:
- 'Mail.Read'
- 'Mail.ReadWrite'
- 'Mail.Send'
- 'offline_access'
- 'Directory.Read.All'
- 'User.Read.All'
condition: selection and filter_high_risk_scopes
falsepositives:
- Legitimate line-of-business app onboarding (maintain an allowlist of approved app IDs)
level: high
KQL (Microsoft Sentinel / Defender)
This hunting query correlates the three identity patterns that matter most: it surfaces successful sign-ins from new countries following recent AiTM-risk indicators, users with MFA fatigue patterns, and freshly consented OAuth apps with mail scopes. Run it daily as a scheduled analytic rule, split into individual rules as your tuning matures.
// Hunt: Identity attack patterns — token replay, MFA fatigue, malicious consent
let lookback = 7d;
let shortWindow = 60m;
// Pattern 1: Impossible travel / token replay — same user, 2+ countries, 60 minutes
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType == 0
| summarize Countries = make_set(LocationDetails.countryOrRegion),
SignInTimes = make_list(TimeGenerated),
IPs = make_set(IPAddress),
Apps = make_set(AppDisplayName)
by UserPrincipalName, bin(TimeGenerated, shortWindow)
| where array_length(Countries) > 1
| extend Pattern = "TokenReplay_ImpossibleTravel"
| project Pattern, UserPrincipalName, TimeGenerated, Countries, IPs, Apps
| union (
// Pattern 2: MFA fatigue — many failures then success
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType in ("500121", "50074", "50126") or ResultType == 0
| summarize Failures = countif(ResultType != 0),
SuccessAfterFailure = countif(ResultType == 0),
FailureCodes = make_set(ResultType)
by UserPrincipalName, bin(TimeGenerated, 30m)
| where Failures >= 5 and SuccessAfterFailure >= 1
| extend Pattern = "MFA_Fatigue"
| project Pattern, UserPrincipalName, TimeGenerated, Failures, SuccessAfterFailure, FailureCodes
)
| union (
// Pattern 3: OAuth consent grants with mail/offline scopes
AuditLogs
| where TimeGenerated > ago(lookback)
| where OperationName has "Consent to application"
| mv-expand TargetResources
| evaluate bag_unpack(TargetResources)
| mv-expand modifiedProperties
| where modifiedProperties.displayName == "ConsentContext.IsAdminConsent" or tostring(modifiedProperties.newValue) has_any ("Mail.Read", "Mail.ReadWrite", "Mail.Send", "offline_access", "Directory.Read.All")
| extend InitiatedBy = tostring(InitiatedBy.user.userPrincipalName),
ConsentDetail = tostring(modifiedProperties.newValue)
| where ConsentDetail has_any ("Mail.Read", "Mail.ReadWrite", "Mail.Send", "offline_access", "Directory.Read.All")
| extend Pattern = "Malicious_OAuth_Consent"
| project Pattern, UserPrincipalName = InitiatedBy, TimeGenerated, displayName, ConsentDetail, CorrelationId
)
| sort by TimeGenerated desc
A complementary hunt for legacy authentication abuse (pattern 4), which should return zero rows in a hardened tenant:
// Hunt: Successful sign-ins via legacy auth protocols (bypass conditional access)
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| where ClientAppUsed in ("IMAP", "POP", "SMTP", "Exchange ActiveSync", "Autodiscover", "Exchange Online PowerShell", "Other clients")
| project TimeGenerated, UserPrincipalName, IPAddress, ClientAppUsed, AppDisplayName, Location, DeviceDetail
| sort by TimeGenerated desc
Velociraptor VQL
Identity attacks often have an endpoint dimension: the AiTM phish lands in the browser, and infostealer-harvested credentials feed patterns 2 and 4. This artifact hunts for suspicious processes accessing browser credential stores and LSASS — the endpoint-side artifacts that frequently accompany the credential theft upstream of these identity attacks.
-- Hunt: Processes accessing browser credential stores or LSASS memory
-- Endpoint-side artifacts of credential theft feeding identity attacks
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(Login Data|Cookies|Local State|Web Data)'
OR Exe =~ '(?i)(\\AppData\\Local\\Temp\\|\\Users\\Public\\|\\ProgramData\\[a-z0-9]{6,}\\)'
OR (Name =~ '(?i)(rundll32|regsvr32|powershell|wscript|cscript)\.exe'
AND CommandLine =~ '(?i)(appdata.*(login|cookie|credential)|lsass)')
ORDER BY CreateTime DESC
Hardening & Audit Script (PowerShell)
This script audits the four control gaps that determine whether these attacks succeed or get blocked: number matching, legacy auth, risky OAuth consents, and stale/guest access. Requires the Microsoft Graph PowerShell SDK with Policy.Read.All, Application.Read.All, and Directory.Read.All.
# Requires: Connect-MgGraph -Scopes "Policy.Read.All","Application.Read.All","Directory.Read.All","AuditLog.Read.All"
Connect-MgGraph -Scopes "Policy.Read.All","Application.Read.All","Directory.Read.All","AuditLog.Read.All" -NoWelcome
$report = [System.Collections.Generic.List[object]]::new()
# 1. Check Authenticator number matching / additional context settings
$authMethods = Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
-AuthenticationMethodConfigurationId MicrosoftAuthenticator -ErrorAction SilentlyContinue
if ($authMethods) {
$feature = $authMethods.AdditionalProperties.featureSettings
$numMatch = $feature.numberMatchingRequiredState.state
$report.Add([pscustomobject]@{ Control = 'Authenticator Number Matching'; Status = $numMatch;
Risk = if ($numMatch -ne 'enabled') { 'HIGH - Push bombing viable' } else { 'OK' } })
}
# 2. Find Conditional Access policies blocking legacy auth (or absence thereof)
$caPolicies = Get-MgIdentityConditionalAccessPolicy -All
$legacyBlock = $caPolicies | Where-Object {
$_.Conditions.ClientAppTypes -contains 'exchangeActiveSync' -or
$_.Conditions.ClientAppTypes -contains 'other'
} | Where-Object { $_.GrantControls.BuiltInControls -contains 'block' -and $_.State -eq 'enabled' }
$report.Add([pscustomobject]@{ Control = 'Legacy Auth Blocked via CA';
Status = if ($legacyBlock) { 'Enabled' } else { 'MISSING' };
Risk = if ($legacyBlock) { 'OK' } else { 'HIGH - IMAP/POP/SMTP spraying viable' } })
# 3. Enumerate OAuth consent grants with high-risk scopes
$highRiskScopes = 'Mail.Read','Mail.ReadWrite','Mail.Send','offline_access','Directory.Read.All','full_access_as_app'
$grants = Get-MgOauth2PermissionGrant -All
foreach ($g in $grants) {
$matched = $highRiskScopes | Where-Object { $g.Scope -match [regex]::Escape($_) }
if ($matched) {
$sp = Get-MgServicePrincipal -ServicePrincipalId $g.ClientId -ErrorAction SilentlyContinue
$report.Add([pscustomobject]@{ Control = 'OAuth Consent Grant';
Status = "$($sp.DisplayName) -> $($matched -join ',')";
Risk = 'REVIEW - Verify business justification' })
}
}
# 4. Check user consent settings (should be disabled or admin-consent workflow)
$authPolicy = Get-MgPolicyAuthorizationPolicy
$consentPolicy = $authPolicy.DefaultUserRolePermissions.PermissionGrantPoliciesAssigned
$report.Add([pscustomobject]@{ Control = 'User Consent Policy';
Status = if (-not $consentPolicy) { 'No user consent allowed (best)' } else { $consentPolicy -join ',' };
Risk = if ($consentPolicy -match 'ManagePermissionGrantsForSelf') { 'MEDIUM - Users can consent to some apps' } else { 'Review' } })
$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\IdentityHardeningAudit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "`nAudit complete. Review all HIGH/REVIEW items before next business day." -ForegroundColor Yellow
Remediation
There is no patch for these four patterns. There is, however, a well-defined set of controls that the data shows separates "blocked" from "breached." Prioritize in this order:
- Enforce number matching and additional context in Microsoft Authenticator for all users, tenant-wide, with no exclusion groups. This single change neutralizes push bombing as a technique.
- Deploy phishing-resistant MFA (FIDO2 security keys or passkeys) for all privileged accounts first, then high-value targets (finance, executives, help desk). FIDO2 binds the credential to the origin domain, which defeats AiTM reverse proxies outright — the attacker cannot replay a key assertion captured on a lookalike domain.
- Block legacy authentication via Conditional Access (or Entra Security Defaults if licensing is constrained). Audit the sign-in logs first with the KQL above to find break-glass dependencies, then enforce.
- Implement token protection Conditional Access policies where licensing permits (Entra ID P2 token protection for Exchange Online and SharePoint Online), which cryptographically binds session tokens to the device and defeats cookie replay.
- Disable user consent to applications and route all consent through the admin consent workflow with a documented review. Audit existing grants with the script above and revoke anything you cannot attribute to a business owner.
- Harden the help desk. Require identity proofing (manager callback, video verification, or hardware-token challenge) before any MFA reset or new device enrollment. MFA fatigue succeeds when the human process is the weakest control.
- Alert on every sign-in anomaly at high severity. The dataset's core lesson — investigate every alert — is only feasible if your identity detections are tuned to a manageable volume. The Sigma and KQL above are the right starting set.
Reference the full report at the BleepingComputer coverage and Microsoft's guidance on token protection and phishing-resistant MFA.
The organizations in this dataset that blocked these attacks were not running exotic tooling. They had done the unglamorous work: number matching on, legacy auth off, consent locked down, help desk drilled, and identity telemetry actually reviewed. That is a two-week project for most tenants. Do it this quarter.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.