Security+ 801 Countdown, T-28: Sessions, Identity Providers, and MFA Bypass Join the Attack Surface

A credential attack is any attempt to obtain or reuse the evidence a system accepts as proof of identity: a password, a password hash, a Kerberos ticket, a session cookie, or a bearer token. The oldest forms guess the password. The forms that matter most in practice skip the password and take what the password produces: an authenticated session. Once a user signs in and passes multifactor authentication (MFA), the server hands the browser a session token, and from that moment the token, not the password, is what the application checks on every request. Whoever holds the token holds the account.

SY0-801 objective 2.5, “Credential attacks,” expands the old password-attack list to five items (password spraying, brute force, user enumeration, replay, and MFA bypass), while objective 2.3 adds browser-based vectors and session keys and objective 2.4 names identity providers and unmanaged or stale credentials as attack surfaces (CompTIA 2025). Together these describe one chain: where a session lives, where it is minted, how attackers take it, and how defenders notice. Microsoft’s 2022 report on an adversary-in-the-middle (AiTM) phishing campaign against more than 10,000 organizations shows the chain end to end; the proxy never broke MFA, and it did not need to, because it kept the cookie that MFA produced (Microsoft Threat Intelligence 2022).

Guessing attacks and the logs that expose them

Three of the five credential attacks are guessing or probing attacks. Password spraying tries one or two common passwords against many accounts, pacing each attempt to stay under any lockout counter (MITRE 2025a). Brute force tries many passwords against one account until one works or the account locks; the physical kind is covered at T-26. User enumeration guesses nothing. It learns which usernames exist by observing that a system answers a real account and a fake one differently, which turns a blind spray into a targeted one. When I teach this in ITN 260, I call spraying width and brute force depth, and enumeration is the reconnaissance that makes both cheaper.

Reading Event 4625

Each pattern leaves a distinct shape in Windows logs. Event 4625 records a failed logon on the computer where it was attempted. Status 0xC000006D (STATUS_LOGON_FAILURE) is generic; the SubStatus separates a nonexistent account (0xC0000064, STATUS_NO_SUCH_USER) from a wrong password (0xC000006A), and 0xC0000234 means locked out. Microsoft lists each code as a value of Status or Sub Status, so filter on both (Microsoft 2026).

// Illustrative Event 4625s on FS01; all LogonType 3 (network)

// A. Password spraying: one source, many accounts, one try each
2026-10-19T07:02:11Z TargetUserName=aking    Status=0xC000006D SubStatus=0xC000006A IpAddress=203.0.113.45
2026-10-19T07:02:12Z TargetUserName=bmorales Status=0xC000006D SubStatus=0xC000006A IpAddress=203.0.113.45
// ...411 more distinct accounts in 6 minutes

// B. Brute force: one account, many tries, then lockout
2026-10-19T08:15:01Z TargetUserName=jsmith Status=0xC000006D SubStatus=0xC000006A IpAddress=198.51.100.23
// ...9 more identical failures in 40 seconds
2026-10-19T08:15:42Z TargetUserName=jsmith Status=0xC0000234 SubStatus=0x0 IpAddress=198.51.100.23

// C. User enumeration: the SubStatus flips on the name that exists
2026-10-19T09:40:03Z TargetUserName=admin         Status=0xC000006D SubStatus=0xC0000064 IpAddress=203.0.113.77
2026-10-19T09:40:03Z TargetUserName=administrator Status=0xC000006D SubStatus=0xC000006A IpAddress=203.0.113.77

Pattern A is width: hundreds of accounts, one failure each, paced under any lockout counter. Pattern B is depth, ending in 0xC0000234 and a domain controller Event 4740 naming the Caller Computer Name. Pattern C is enumeration; Microsoft notes that several 0xC0000064 events in a row can signal it. Web applications leak the same fact through differing error messages, status codes, or timing (T1589), which is why OWASP prescribes one generic message and equal work for real and fake accounts (OWASP n.d.).

The same three shapes appear beyond the file server. On domain controllers, a Kerberos pre-authentication failure is Event 4771 code 0x18, and a ticket request for an unknown user is Event 4768 result 0x6. MITRE notes that Kerberos and LDAP spraying is less likely to raise high-visibility events, so collect DC logs too. Entra ID sign-in logs show the same shapes as ResultType 50126 (bad password), 50034 (no such account), and 50053 (locked or blocked) (Microsoft n.d.-b).

Why lockout thresholds miss spraying

Account lockout is the control most administrators reach for, and it is tuned for depth, not width. The Windows “Account lockout threshold” ranges from 0 (never) to 999; the Default Domain Policy uses 0, security baselines recommend 10, and Microsoft warns that any threshold lets an attacker lock every account (Microsoft n.d.-a). Entra smart lockout trips after 10 failures with a 60-second first lockout (Microsoft n.d.-c), and NIST SP 800-63B-4 §3.2.2 caps consecutive failures at 100 (NIST 2025). One guess per account trips none of them, and Entra’s Password spray detection fires only after a password validates (Microsoft n.d.-e). The table is my synthesis of those sources: the shape of a signal, its most likely reading, and what to check next.

Signal	Most likely reading	Check next
Many accounts locked in minutes, one source or ASN	Spray past the threshold, or lockout denial of service	Any success from that source
One account locking repeatedly	Brute force, or a device with a stale saved password	4740 Caller Computer Name
Bursts of 0xC0000064, 50034, or Kerberos 0x6	User enumeration	Names with a different result
Success right after a failure burst	Spray or brute-force hit	Reset password; review MFA methods
Impossible travel, MFA passed both times	Password plus MFA bypass, or VPN egress	MFA approval details
Concurrent sessions, or a new ASN with no MFA prompt	Cookie or token replay	Revoke sessions; hunt AiTM or infostealer

Impossible travel is arithmetic: sign-ins from Richmond, Virginia at 13:02 UTC and Frankfurt at 13:41 UTC are about 6,657 km apart (haversine), implying about 10,240 km/h. VPN egress and IP geolocation error cause false positives, so check the MFA details before treating it as a verdict.

Replay and MFA bypass: taking the session

The remaining two credential attacks do not guess. NIST defines a replay attack as replaying captured claimant-verifier messages to masquerade as the claimant (NIST n.d.). The captured material is rarely a plaintext password; it is usually a derived credential the system accepts as proof. ATT&CK groups these under T1550, Use Alternate Authentication Material: Pass the Hash (.002) uses an NTLM hash without the plaintext, Pass the Ticket (.003) reuses Kerberos tickets, and Web Session Cookie (.004), industry’s “pass-the-cookie,” bypasses some MFA “since the session is already authenticated” (MITRE n.d.). RFC 6750 explains why a stolen cookie works at all: a bearer token works for any party in possession of it (Jones and Hardt 2012). The server cannot tell the browser that earned the token from the attacker who copied it.

MFA bypass is the umbrella term for getting past a second factor without breaking it. Microsoft says of AiTM, “this is not a vulnerability in MFA” (Microsoft Threat Intelligence 2022); attackers steal what MFA produced, trick the approver, or attack a weaker channel:

• Push fatigue: repeated prompts until someone approves (T1621; MITRE 2025b), as an Uber contractor did in September 2022 (Uber 2022).
• AiTM phishing: a reverse proxy holds two TLS sessions (victim to proxy, proxy to the real IdP), relays the password and MFA step, and keeps the post-MFA cookie.
• Infostealer theft: malware such as LummaC2 or RedLine copies already-authenticated cookies from disk or memory (T1539; MITRE 2026).
• SIM swap: a deceived carrier moves the victim’s number to an attacker SIM, which receives the SMS codes (T1451; CISA 2022).
• Help-desk reset: callers “convince IT help desk personnel to reset passwords and/or transfer MFA tokens” (CISA 2023).
• Downgrade or modification: after access, registering the attacker’s own or a weaker method, or exempting the account from conditional access (T1556.006).

In Entra’s Authentication Details, push fatigue looks like repeated “user declined the authentication” results before a success (Microsoft n.d.-d). AiTM and infostealer theft show up later, as the concurrent-session and new-ASN rows in the table above, because the sign-in that minted the cookie was genuine. NIST SP 800-63B-4 §3.1.3 now calls approval-only push “no longer considered acceptable” and classes the phone network as a restricted authenticator; the defenses are T-11’s.

Browsers, cookies, and session keys

A session lives in the browser, so the browser-based vectors in objective 2.3 are the ways an attacker reaches the token from inside the client. Extensions inherit the browser’s permissions and can capture what users enter (T1176.001). Injected JavaScript can steal cookies (T1539) unless the HttpOnly flag blocks document.cookie reads. Password managers become a vector when vaults or master passwords are pulled from memory or disk (T1555.005).

Three terms in this area are easy to blur. A cookie is the HTTP state mechanism; a session token is the bearer value, carried in a cookie or an Authorization: Bearer header. “Session keys,” which 2.3 lists under network-based vectors, is undefined by CompTIA; I read it as the symmetric keys negotiated per TLS or Kerberos session, whose theft from memory or logs exposes captured traffic (mechanics at T-34). A stolen session key decrypts traffic; a stolen session token impersonates a user.

Hardening the cookie itself comes down to a few attributes (the 4.1 “secure cookies” control is T-16’s):

Set-Cookie: __Host-sid=4f9c2e7a1b8d03c6e5a9f17b2d4c8e60; Path=/; Secure; HttpOnly; SameSite=Lax

The __Host- prefix requires Secure, Path=/, and no Domain, blocking subdomain overwrite; Secure keeps it off plain HTTP; HttpOnly hides it from scripts; SameSite=Lax limits cross-site sending, a CSRF defense in depth (IETF HTTPBIS Working Group 2025). The 32 hex characters carry 128 bits, above the 64-bit floor in SP 800-63B-4 §5.1. No flag stops an infostealer copying the cookie store or an AiTM proxy receiving it legitimately, so add short timeouts, session revocation on password reset, and Device Bound Session Credentials (DBSC), which tie short-lived cookies to a TPM-held key; Google said on April 9, 2026 that DBSC was entering public availability on Chrome 146 for Windows, with macOS to follow (Ackerman, Rubery, and Ehinger 2026).

Identity providers and stale credentials

An identity provider (IdP) authenticates users and issues the tokens or assertions that other applications, the relying parties, accept instead of checking a password themselves. That makes it every relying party’s trust anchor, so its compromise has total blast radius: an attacker who can sign tokens needs nobody’s password or second factor. In May and June 2023, Storm-0558 used a 2016 Microsoft consumer (MSA) signing key plus an Exchange Online token-validation flaw to forge tokens that reached mailboxes at 22 organizations and 503 personal accounts. A customer caught it: the State Department’s “Big Yellow Taxi” rule on the MailItemsAccessed log, which required Purview Audit (Premium), fired on June 15, 2023 (Cyber Safety Review Board 2024). Golden SAML (T1606.002) is the on-premises version: whoever holds the AD FS token-signing certificate mints tokens with any claims, bypassing MFA. Neither is the 2.5 application attack “Forgery,” which most likely means request forgery.

Stale credentials are known accounts or keys that nobody tracks or rotates. From late November 2023, Midnight Blizzard sprayed a “legacy non-production test tenant account” that lacked MFA, using few attempts through residential proxies, which defeats per-IP grouping. It then abused a legacy test OAuth application to gain full_access_as_app in Exchange Online, and Microsoft detected it on January 12, 2024 (Microsoft Security Response Center 2024; Microsoft Threat Intelligence 2024). In the UNC5537 Snowflake intrusions, at least 79.7 percent of the accounts used had prior credential exposure, some unrotated for up to four years; the accounts lacked MFA (Mandiant 2024). In both cases the account was legitimate and had no second factor, so no lockout counter and no MFA prompt stood between the attacker and the data. Stale credentials are not Shadow IT, which is covered at T-29.

What you need to know for SY0-801

• Spraying is many accounts, one or two common passwords, under the lockout threshold; brute force is many passwords, one account; enumeration learns which usernames exist and guesses nothing.
• Replay means reusing captured authentication material (hash, ticket, cookie, or token) and sits under both Credential attacks and Application attacks in objective 2.5.
• Prompt flood, then an approval: push fatigue. Look-alike sign-in page where MFA “worked”: AiTM. Phone suddenly loses service: SIM swap. Caller obtained a factor reset: help-desk social engineering.
• AiTM is a phishing proxy that captures a post-MFA cookie, not the 2.5 network attack “On-path.”
• CompTIA defines neither “MFA bypass” nor “Session keys,” and AiTM, pass-the-hash, pass-the-ticket, and Golden SAML appear nowhere in the objectives; they are the machinery behind the listed terms.
• The 2.5 indicators of compromise are account lockout, concurrent sessions (701-era materials say “concurrent session usage”), and impossible travel; concurrent sessions with no MFA prompt points to token replay, and impossible travel with MFA passed both times points to a bypassed factor or a VPN.
• “Identity providers” (2.4) is the trust-anchor risk; Federation and SSO (objective 4.5) are the design.
• “Password managers” is both a 2.3 vector and a 4.5 control, so read the verb in the stem.

Check yourself

These are my own practice questions.

1. Event 4625 on a file server shows failures from 203.0.113.80 over eight minutes: 350 distinct accounts, one attempt each, all SubStatus 0xC000006A, and no lockouts. Which credential attack is most likely?

• A. Brute force.
• B. Password spraying.
• C. User enumeration.
• D. Replay.

Answer: B. Many real accounts (wrong password, not unknown user), one try each, under the threshold is spraying. Enumeration would show mostly 0xC0000064; brute force targets one account.

2. A user signs in through an emailed link and approves the push prompt. Minutes later, a second session for the account appears from a hosting provider’s network with no MFA prompt and no failed sign-ins. Which action best contains the incident?

• A. Lower the lockout threshold to three attempts.
• B. Revoke the account’s sessions and tokens, then reset the password.
• C. Show specific login error messages.
• D. Renegotiate the web server’s TLS session keys.

Answer: B. This fits AiTM: the proxy captured the post-MFA cookie and is replaying it. A stolen session lasts until the server invalidates it, and lockout never saw a failure.

3. An attacker exported an AD FS token-signing certificate and signed SAML assertions with administrator claims for several SaaS applications, although every user had MFA. Which SY0-801 item does this best illustrate?

• A. Unmanaged/stale credentials.
• B. Identity providers.
• C. Session keys.
• D. Forgery, as an application attack.

Answer: B. The certificate lets the attacker mint tokens every relying party trusts, without MFA (Golden SAML). Application-attack forgery most likely means request forgery; MITRE’s recovery step is rotating the certificate twice in quick succession.

This is T-28 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-27: Social Engineering Gets Whaling, Quishing, and Deepfakes. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Ackerman, Benjamin, Daniel Rubery, and Guillaume Ehinger. 2026. “Protecting Cookies with Device Bound Session Credentials.” Google, April 9, 2026.

CISA. 2022. Implementing Phishing-Resistant MFA. Fact sheet.

CISA. 2023. “Scattered Spider.” Cybersecurity Advisory AA23-320A, updated July 29, 2025.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Cyber Safety Review Board. 2024. Review of the Summer 2023 Microsoft Exchange Online Intrusion. Report dated March 20, 2024.

IETF HTTPBIS Working Group. 2025. “Cookies: HTTP State Management Mechanism.” Internet-Draft draft-ietf-httpbis-rfc6265bis-22, December 1, 2025. Work in progress; not yet an RFC.

Jones, Michael B., and Dick Hardt. 2012. The OAuth 2.0 Authorization Framework: Bearer Token Usage. RFC 6750. Internet Engineering Task Force.

Mandiant. 2024. “UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion.” Google Cloud Blog, June 10, 2024.

Microsoft. 2026. “4625(F) An Account Failed to Log On.” Microsoft Learn. See also the pages for events 4740, 4768, and 4771.

Microsoft. n.d.-a. “Account Lockout Threshold.” Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-b. “Microsoft Entra Authentication and Authorization Error Codes.” Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-c. “Prevent Attacks Using Smart Lockout.” Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-d. “Sign-in Event Details for Microsoft Entra MFA.” Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-e. “What Are Risk Detections?” Microsoft Learn. Accessed October 12, 2026.

Microsoft Security Response Center. 2024. “Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard.” MSRC Blog, January 19, 2024.

Microsoft Threat Intelligence. 2022. “From Cookie Theft to BEC: Attackers Use AiTM Phishing Sites as Entry Point to Further Financial Fraud.” Microsoft Security Blog, July 12, 2022.

Microsoft Threat Intelligence. 2024. “Midnight Blizzard: Guidance for Responders on Nation-State Attack.” Microsoft Security Blog, January 25, 2024.

MITRE. 2025a. “Password Spraying.” MITRE ATT&CK, Technique T1110.003, version 1.8.

MITRE. 2025b. “Multi-Factor Authentication Request Generation.” MITRE ATT&CK, Technique T1621, version 1.2.

MITRE. 2026. “Steal Web Session Cookie.” MITRE ATT&CK, Technique T1539, version 1.5.

MITRE. n.d. “Use Alternate Authentication Material: Web Session Cookie.” MITRE ATT&CK, Technique T1550.004. Accessed October 12, 2026. See also techniques T1550.002, T1589, T1451, T1556.006, T1606.002, T1176.001, and T1555.005.

NIST (National Institute of Standards and Technology). 2025. Digital Identity Guidelines: Authentication and Authenticator Management. NIST Special Publication 800-63B-4.

NIST (National Institute of Standards and Technology). n.d. “Replay Attack.” CSRC Glossary. Accessed October 12, 2026.

OWASP. n.d. “Authentication Cheat Sheet.” OWASP Cheat Sheet Series. Accessed October 12, 2026.

Uber. 2022. “Security Update.” Uber Newsroom, September 16, 2022.