How Attackers Pivot Between Endpoints and Identities
Summary
Huntress explains how attackers use stolen credentials, session tokens and rogue apps to move between endpoints and identities, illustrating the risks with three cases and arguing for combined endpoint and identity monitoring.
Key points
- Huntress reports that identity-related incidents made up 67% of its critical and high-severity incidents in 2024 and 81% in the first two months of 2025.
- The article describes identity attacks involving phishing, adversary-in-the-middle techniques, stolen credentials or session cookies, OAuth abuse, and changes to MFA or inbox rules.
- It outlines attack paths from compromised endpoints to cloud identities, and from stolen identities to endpoint compromise.
- Huntress describes a healthcare case involving a former doctor's active credentials; it says its team detected and stopped the attacker before ransomware deployment.
- In two other cases, Huntress says it detected an attempted mailbox session replay at an oil and gas firm and found a suspicious, high-permission OAuth app at a school district.
- The article argues that endpoint-only or identity-only security can miss activity across the other attack surface, and promotes Huntress's managed EDR and ITDR services.
Article Details
- Topic
- Identity-based cyberattacks and the need to detect threats across both identities and endpoints
MITRE ATT&CK
T1003 · OS Credential DumpingThe article describes dumping credentials from memory during an endpoint-to-identity attack path.T1098 · Account ManipulationThe article describes attackers changing MFA devices and creating rogue apps to maintain access.T1114 · Email CollectionThe article describes creating inbox rules as a persistence method.T1539 · Steal Web Session CookieThe article describes stealing browser session cookies to bypass MFA.T1550.004 · Web Session CookieThe article describes using stolen session cookies to access cloud services.T1566 · PhishingThe article describes phishing used to steal credentials and compromise endpoints.T1567 · Exfiltration Over Web ServiceThe article describes exfiltrating data after gaining identity or endpoint access.
People
Vendors
Products
EdgeThey may use stolen session cookies from browsers like Chrome or Edge to bypass MFA.Google ChromeThey may use stolen session cookies from browsers like Chrome or Edge to bypass MFA.Huntress Managed EDRIf you’re already using Huntress Managed EDR, you’re halfway protected.Huntress Managed ITDRIdentity Threats Got a Whole Lot Nastier, But So Did We: Introducing the New Huntress Managed ITDR, Now with Rogue AppsMicrosoft 365 Apps for EnterpriseEndpoint protection may catch the malware in this flow, but it won't stop the attacker from logging into Microsoft 365 and escalating.Microsoft Defender Antimalware PlatformAnd yes, we manage Microsoft Defender too, at no extra charge.