Engage Goals: EGO0002 Affect
Engage Approach: EAP0004 Direct
Engage Actions: EAC0004 Network Analysis, EAC0016 Network Manipulation
Name of Element: Deceptive Identity Provider (IdP) Responses
Description of Element:
Goal: Redirect attackers attempting to authenticate to a deceptive environment.
Approach: Manipulating IdP responses to redirect authentication flows.
When an attacker attempts to authenticate through an IdP (e.g., OAuth, SAML), manipulate the response to redirect them to a fake login portal or a controlled environment.
Technical Context:
This element requires the ability to intercept and modify IdP traffic. This can be achieved through network manipulation, proxy servers, or by compromising a non-critical IdP within the organization. This aligns with the MITRE ATT&CK technique T1606 (Compromise Accounts).
Other:
This element can be particularly effective against attackers attempting to exploit vulnerabilities in Single Sign-On (SSO) systems.