Security · Security Architecture
IT Attack Paths
How real intrusions chain individually minor weaknesses into full compromise, and where defensive controls interrupt the chain.
AdvancedUpdated 2026-09-01
Overview
Attackers rarely exploit one dramatic vulnerability. They chain a phishing email, a reused credential, a missing MFA policy, an over privileged account and a flat network. Mapping the chain shows which single control removes the most risk.
These paths are documented here for defence: each stage lists the detections and controls that break it. They are deliberately generic and contain no operational tooling detail.
Sequence
- 1Phishing / AiTM proxy
- 2Credential or token theft
- 3MFA bypass or fatigue
- 4Identity access
- 5Privilege escalation
- 6SaaS and cloud access
- 7Data theft or extortion
Broken by: phishing resistant MFA, device compliance requirements, session risk policy, consent governance, mailbox and file audit alerting.
Layer model
Endpoint centred path
Malicious document or exploitPersistence via task, service or run keyCredential dumping from memoryLateral movement over SMB/RDP/WMIDomain privilege escalationInfrastructure and backup compromise
Controls that break it
Application control and macro restrictionsEDR with tamper protectionLSA protection and credential guardHost firewall blocking workstation to workstation trafficTiered administration and PAWsImmutable, credential isolated backups
Cloud path
Exposed management interface or leaked keyOver permissive role or trust policyEnumeration of resourcesPersistence via new credential or federation trustData access in storage or databaseExfiltration to attacker controlled storage
Security considerations
- Run attack path analysis regularly; graph based tools reveal privilege relationships no spreadsheet captures.
- Prioritise remediation by path impact, not by individual finding severity.
- Validate assumptions with purple team exercises rather than trusting configuration alone.