Field notes from the identity layer¶

The endpoint is a triangle: the device, the identity it holds, and the cloud it authenticates to. Compromise any corner and you can reach the other two. These notes follow that triangle, from the surface you enumerate before touching anything, through the evasion techniques that keep you invisible on the device, to the credential and session material that carries you into everything the user could reach.

The device is just the keyring:

Endpoint surface discovery
EDR evasion
Fileless and ephemeral attacks
Credential and session theft
The browser as attack surface
Mobile exploitation
USB and physical attacks