Full Report
Do you know where identity attacks come from? It’s not just location or VPNs, but there’s a "secret third thing" in identity attacks. See how a new AS-based detection system closed this critical visibility gap.
Analysis Summary
# Tool/Technique: AS-Based Identity Attack Detection
## Overview
This technique involves monitoring and analyzing **Autonomous System (AS)** infrastructure—specifically Datacenter and Hosting provider networks—to identify identity-based attacks. While traditional detection focuses on geographic "Impossible Travel" or known VPN/TOR exit nodes, this "secret third thing" identifies attackers who rent virtual private servers (VPS) or cloud infrastructure to launch Business Email Compromise (BEC) and session hijacking attacks, often bypassing geo-fencing and consumer VPN blacklists.
## Technical Details
- **Type**: Detection Technique / Investigative Procedure
- **Platform**: Cloud Identity Providers (e.g., Microsoft 365, Azure AD, Okta)
- **Capabilities**: Identification of infrastructure-based obfuscation, detection of "Impossible Travel" bypasses, and correlation of disparate attack stages (Signal Co-occurrence).
- **First Seen**: Documented by Huntress in late 2024/December 2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1078 - Valid Accounts]
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- **[TA0007 - Discovery]**
- [T1087.004 - Account Discovery: Cloud Account]
- **[TA0003 - Persistence]**
- [T1136.003 - Create Account: Cloud Account]
- [T1505.005 - Serverless Execution (via Malicious OAuth Apps)]
## Functionality
### Core Capabilities
- **AS Attribution**: Categorizing login events by the Autonomous System Organization (e.g., AWS, DigitalOcean, Linode, OVH) rather than just IP or City/Country.
- **Negative Space Analysis**: Identifying gaps where an identity attack is occurring (e.g., suspicious inbox rules) but the initial access was not flagged because it originated from a "clean" domestic datacenter IP.
- **Signal Co-occurrence**: Linking disparate alerts (Login -> App Installation -> Inbox Rule) to build a full attack chain.
### Advanced Features
- **Failed Login Characterization**: Analyzing patterns of failed attempts originating from datacenter infrastructure to predict brute force or spraying campaigns.
- **Rapid Identity Triage**: Accelerated investigation by filtering for non-consumer/non-corporate ISP traffic.
## Indicators of Compromise
*Note: As this is a technique overview, specific hashes are not provided; instead, behavioral indicators are prioritized.*
- **Network Indicators**:
- Logins originating from ASN associated with: `Amazon[.]com`, `DigitalOcean`, `Microsoft Corporation (Azure)`, `Linode`, `OVH`.
- IP addresses that resolve to hosting providers rather than residential ISPs (Comcast, AT&T, etc.).
- **Behavioral Indicators**:
- **Impossible Travel**: A user logging in from a residential IP in New York and five minutes later from an AWS datacenter IP in Virginia.
- **Session Hijacking**: A valid session suddenly shifting from a known user ISP to a hosting provider AS.
- **Malicious OAuth Applications**: Authorization of new, unverified applications from datacenter-based IPs.
## Associated Threat Actors
- **BEC Groups**: Financial fraudsters using VPS to mask their true location.
- **Scattered Spider / UNC3944**: Known for sophisticated identity-based persistence and infrastructure use.
- **State-Sponsored Actors**: Utilizing domestic (US-based) cloud infrastructure to evade geographic blocks.
## Detection Methods
- **Behavioral Detection**: Flagging any successful login to a corporate identity tenant that originates from a Datacenter/Hosting AS if the user has no known administrative role requiring such access.
- **Infrastructure Correlation**: Cross-referencing the "First Seen" time of a new AS for a specific user.
- **Anomaly Detection**: Identifying a shift in the ratio of Residential vs. Datacenter traffic for a specific tenant.
## Mitigation Strategies
- **Conditional Access Policies**: Restrict logins from known datacenter IP ranges if not required for business operations.
- **MFA Hardening**: Enforcing FIDO2 or certificate-based authentication to prevent session hijacking and bypasses.
- **Continuous Access Evaluation (CAE)**: Implementing protocols that revoke sessions immediately when a change in network location/AS is detected.
- **ISP/ASN Filtering**: Implementing "Impossible Travel" logic that specifically weighs Datacenter origins as higher risk than Residential origins.
## Related Tools/Techniques
- **Impossible Travel**: The precursor technique focusing on geography.
- **VPN/Proxy Detection**: The technique focusing on commercial anonymity tools.
- **OAuth Application Auditing**: Investigating the persistence mechanisms often deployed after a Datacenter-based login.