Technical

Identity Investigation Playbook

by David Simpson · Published 2026-08-23

Created with Inkfluence AI

40 chapters 22,472 words ~90 min read English

Practical investigation and response to identity-based cyber attacks

1. OAuth 2.0 Authorization Code Flow
2. OIDC ID Token Validation
3. SAML Assertions and Audience
4. Kerberos Ticket Lifecycle Checks
5. Active Directory Authentication Logs
6. Azure AD Sign-In Logs Triage
7. AWS IAM Access Analyzer Findings
8. Google Workspace Login Audit
9. MFA Enrollment and Reset Events
10. TOTP Time-Step Drift Detection
11. FIDO2/WebAuthn Challenge Replay
12. Push MFA Fatigue Patterns
13. Password Reset Token Abuse
14. Email-to-Account Recovery Abuse
15. OAuth Refresh Token Theft Signals
16. Session Cookie Theft and Reuse
17. API Key Authentication and Rotation
18. JWT Claims and Critical Misconfigurations
19. Privilege Escalation via Group Membership
20. Role Assignment Drift in RBAC
21. ADCS Enrollment and Template Abuse
22. Certificate Revocation and OCSP Failures
23. Kerberos Constrained Delegation Misuse
24. Pass-the-Hash via SMB Authentication
25. Pass-the-Ticket with SPN Anomalies
26. Golden Ticket Indicators in AD
27. Overpass-the-Hash and NTLM Relay
28. Identity-Based Intrusion Kill Chain
29. Attack Decision Tree: Credential vs Token
30. Attack Decision Tree: MFA Bypass vs Fatigue
31. Attack Decision Tree: Privilege Abuse Origin
32. Attack Decision Tree: Lateral Movement Identity
33. Evidence Collection: Audit Logs and Timeline
34. Evidence Collection: Token Introspection Artifacts
35. Commands: Linux/Windows Log and Event Queries
36. Commands: PowerShell for AD Identity Triage
37. Lab: MFA Reset Incident Response
38. Lab: Privilege Abuse After Token Theft
39. Audit-Ready Fix Verification Checklist
40. Senior Playbook: Identity Investigation Runbook

Preview: OAuth 2.0 Authorization Code Flow

A short excerpt from “OAuth 2.0 Authorization Code Flow”. The full book contains 40 chapters and 22,472 words.

Overview

Could a valid authorization code be enough to take over an account? In OAuth 2.0, it can be when an attacker captures the code and defeats redirect URI validation. This reference covers the Token Trail Map: trace the authorization request, redirect, code exchange, and resulting tokens to determine whether redirect URI abuse caused account compromise.

Quick Reference

Stage	Method	Endpoint or artifact	Investigation value
Authorization	`GET`	`/authorize`	Identify client, redirect URI, scope, and user session
Code delivery	Browser redirect	`redirect_uri?code=...`	Determine whether the code was exposed or altered
Token exchange	`POST`	`/oauth/token`	Confirm code redemption and client authentication
Refresh	`POST`	`/oauth/token`	Identify persistence after initial takeover
Revocation	`POST`	`/oauth/revoke`	Invalidate refresh and access tokens

Parameters

Parameter	Type	Required	Description
`response_type`	string	Yes	Must be `code`; reject implicit token delivery
`client_id`	string	Yes	Registered OAuth client identifier
`redirect_uri`	URI	Yes	Must exactly match the registered URI, including scheme, host, path, and port
`scope`	string	Yes	Requested permissions; investigate unexpected privileged scopes
`state`	string	Yes	Unpredictable request correlation value; prevents login-CSRF and response mix-up
`code_challenge`	string	Yes	PKCE challenge derived from the verifier
`code_challenge_method`	string	Yes	Use `S256`; reject `plain`
`code`	string	Yes at token exchange	Short-lived, single-use authorization code
`code_verifier`	string	Yes with PKCE	Secret value proving possession of the original client session

Code Example

bash

# Authorization request: exact redirect URI and PKCE are mandatory.
AUTH_URL="https://idp.example.com/authorize"
curl -G "$AUTH_URL" \
  --data-urlencode "response_type=code" \
  --data-urlencode "client_id=investigation-console" \
  --data-urlencode "redirect_uri=https://console.example.com/oauth/callback" \
  --data-urlencode "scope=openid profile email" \
  --data-urlencode "state=$(openssl rand -hex 32)" \
  --data-urlencode "code_challenge=BASE64URL_SHA256_VERIFIER" \
  --data-urlencode "code_challenge_method=S256"

# Exchange the captured code only at the registered token endpoint.
curl -sS -X POST https://idp.example.com/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode 'client_id=investigation-console' \
  --data-urlencode 'redirect_uri=https://console.example.com/oauth/callback' \
  --data-urlencode 'code=AUTHORIZATION_CODE' \
  --data-urlencode 'code_verifier=ORIGINAL_VERIFIER'

For an incident, compare authorization and token-exchange timestamps, source IPs, user agents, client IDs, and redirect URIs. A code redeemed from a different network or device within its validity window is a high-value correlation.

Response Format

json

{
  "access_token": "redacted",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "redacted",
  "scope": "openid profile email"
}

`access_token` authorizes API calls. `refresh_token` may preserve access after the original code expires. `expires_in` is the lifetime in seconds. Do not place tokens in URLs, browser history, referrer headers, or incident tickets.

Notes & Best Practices

Reject redirect URI prefixes, wildcards, user-controlled subdomains, and HTTP except for controlled local development. Exact matching prevents `https://console.example.com.attacker.example` abuse.
Authorization codes should be single-use and short-lived, commonly 60-120 seconds. Log failed reuse, redirect mismatch, PKCE failure, and client mismatch events.
In the Token Trail Map, connect `state`, code ID, client ID, redirect URI, token issuance event, and refresh-token activity. Revoke refresh tokens and sessions, then preserve the related logs as audit evidence.
Decision tree: If the redirect URI differs, classify as registration or validation abuse. If it matches but the code was redeemed elsewhere, investigate interception or callback compromise. If PKCE failed open, treat the code as potentially replayable and review all tokens issued from that client.

About this book

"Identity Investigation Playbook" is a technical book by David Simpson with 40 chapters and approximately 22,472 words. Practical investigation and response to identity-based cyber attacks.

This book was created using Inkfluence AI, an AI-powered book generation platform that helps authors write, design, and publish complete books. It was made with the AI Documentation Generator.

Frequently Asked Questions

What is "Identity Investigation Playbook" about?

Practical investigation and response to identity-based cyber attacks

How many chapters are in "Identity Investigation Playbook"?

The book contains 40 chapters and approximately 22,472 words. Topics covered include OAuth 2.0 Authorization Code Flow, OIDC ID Token Validation, SAML Assertions and Audience, Kerberos Ticket Lifecycle Checks, and more.

Who wrote "Identity Investigation Playbook"?

This book was written by David Simpson and created using Inkfluence AI, an AI book generation platform that helps authors write, design, and publish books.

How can I create a similar technical book?

You can create your own technical book using Inkfluence AI. Describe your idea, choose your style, and the AI writes the full book for you. It's free to start.