SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Identity, authentication and credential attacks

Adversary-in-the-middle phishing kits

Reverse-proxy phishing (Evilginx, EvilProxy, Tycoon 2FA) relays credentials and captures session cookies

categoryIdentity, authentication and credential attacksseverityHighdetectabilityHighlabnot yet measured

Example: Tycoon 2FA hits 500k orgs/month

Classification

40 values: 10 reviewed, 21 imported, 9 derived. What do these mean?

Exploitability

Attack vector	Credential attacksNetwork attacksSocial engineering
Reach (CVSS)	Social
Attack complexity	Low
Privileges required	None
User interaction	Active
Attacker skill required	High
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	LinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
Environment	CloudMobileOn-premises
Target asset class	HumanIdentity
Kill-chain phase (tactic)	CollectionCredential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentFile AccessFile ModificationLogon Session CreationNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess AccessProcess CreationUser Account AuthenticationWindows Registry Key Modification

Detection & response

Mitigated by 31

Detected by 25

DET0296 attack-detection-strategy
DET0509 attack-detection-strategy
0ed99dda-6a35-11ef-8c99-0242ac120002 sigma
16f5d8ca-44bd-47c8-acbe-6fc95a16c12f sigma
2074e137-1b73-4e2d-88ba-5a3407dbdce0 sigma
24c77512-782b-448a-8950-eddb0785fc71 sigma
3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09 sigma
4096842a-8f9f-4d36-92b4-d0b2a62f9b2a sigma
4627c6ae-6899-46e2-aa0c-6ebcb1becd19 sigma
4833155a-4053-4c9c-a997-777fcea0baa7 sigma
50e606bf-04ce-4ca7-9d54-3449494bbd4b sigma
5588576c-5898-4fac-bcdd-7475a60e8f43 sigma
5589ab4f-a767-433c-961d-c91f3f704db1 sigma
56fa3cd6-f8d6-4520-a8c7-607292971886 sigma
679085d5-f427-4484-9f58-1dc30a7c426d sigma
a557ffe6-ac54-43d2-ae69-158027082350 sigma
a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 sigma
b07e58cf-cacc-4135-8473-ccb2eba63dd2 sigma
bb0e87ce-c89f-4857-84fa-095e4483e9cb sigma
bc2e25ed-b92b-4daa-b074-b502bdd1982b sigma
c2c76b77-32be-4d1f-82c9-7e544bdfe0eb sigma
cd8c163e-a19b-402e-bdd5-419ff5859f12 sigma
d22df9cd-2aee-4089-93c7-9dc4eae77f2c sigma
e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c sigma
ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4 sigma

Tested by 6

26a6b840-4943-4965-8df5-ef1f9a282440 atomic
4b437357-f4e9-4c84-9fa6-9bcee6f826aa atomic
b647f4ee-88de-40ac-9419-f17fac9489a7 atomic
deecd55f-afe0-4a62-9fba-4d1ba2deb321 atomic
e43cfdaf-3fb8-4a45-8de0-7eee8741d072 atomic
e57ba07b-3a33-40cd-a892-748273b9b49a atomic

Attack relationships

Child: ARP spoofing / poisoning
Child: DHCP starvation
Child: Evil twin AP
Child: LLMNR / NBT-NS / mDNS poisoning
Child: NTLM relay / name-resolution poisoning
Child: Rogue DHCP / DHCP spoofing
Child: SMB / NTLM relay

Framework references

Primary source: https://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/
attack: T1557 (primary)
attack: T1539

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 346 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 29 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 9 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)