Full Report
Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn't exist. Since no real victim monitors misuse, a
Analysis Summary
# Tool/Technique: Synthetic Machine Identity (Fabricated NHI)
## Overview
Synthetic machine identity fraud is a technique where an attacker manufactures a new, non-human identity (NHI)—such as a service account or workload identity—rather than stealing an existing one. By "frankensteining" real environmental attributes (naming conventions, metadata, domain info) with fabricated credentials, the attacker creates a "shadow" identity that appears legitimate but has no human owner or authorized purpose. Because no real user is being impersonated, there is no victim to report suspicious activity, allowing the identity to accumulate privileges silently.
## Technical Details
- **Type**: Technique (Identity Fraud / Persistence)
- **Platform**: Cloud Environments (AWS, Azure, GCP), On-premise Active Directory, SaaS platforms.
- **Capabilities**: Persistence, Privilege Escalation, Evasion of traditional identity monitoring.
- **First Seen**: Concept evolved from human synthetic fraud; specialized application to NHIs noted in 2024-2026.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1136 - Create Account]**
- **[T1136.002 - Create Account: Domain Account]**
- **[TA0004 - Privilege Escalation]**
- **[T1098 - Account Manipulation]**
- **[T1078 - Valid Accounts]**
- **[TA0006 - Credential Access]**
- **[T1207 - Rogue Domain Controller]** (specifically for DCShadow)
- **[TA0005 - Defense Evasion]**
- **[T1550 - Use Alternate Authentication Material]**
## Functionality
### Core Capabilities
- **Blending In**: Adheres to organizational naming schemas (e.g., `svc_backup_01`) to avoid detection by administrators.
- **Credential Implantation**: Injecting attacker-controlled keys or certificates into existing objects to act on their behalf.
- **Self-Authorization**: Requesting or granting permissions similar to existing machine identities to maintain a low profile.
### Advanced Features
- **Infrastructure Fabrication (DCShadow)**: Temporarily registering a rogue domain controller to push malicious changes via replication traffic, making the fake identity information appear to come from a trusted source of authority.
- **Shadow Credentials**: Attaching new authentication material to an existing object so the identity remains "real" but the access is "forged."
## Indicators of Compromise
- **File Hashes**: N/A (Technique-based)
- **File Names**: N/A
- **Registry Keys**: `HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters` (Monitoring for DCShadow-related modifications).
- **Network Indicators**: High volumes of replication traffic from unauthorized/newly registered hosts (potential DCShadow activity).
- **Behavioral Indicators**:
- Creation of service accounts with no corresponding HR or ticketing system record.
- NHIs created with high-level privileges immediately upon "birth."
- Account activity originating from unusual Geolocations or IP ranges relative to the environment's standard workloads.
## Associated Threat Actors
- While specific groups were not named in the article, these techniques are commonly associated with:
- Advanced Persistent Threats (APTs) seeking long-term persistence.
- Financially motivated groups targeting cloud-native environments.
## Detection Methods
- **Behavioral Detection**: Monitoring for "Orphaned" identities—accounts that lack a human owner or association with a verified project/application.
- **Log Analysis**: Identifying successful authentication from newly created service accounts that do not follow established provisioning workflows.
- **Infrastructure Auditing**: Using tools to detect unauthorized Domain Controller registrations or modifications to `msDS-KeyCredentialLink` attributes (Shadow Credentials).
## Mitigation Strategies
- **Governance & Ownership**: Ensure every Non-Human Identity (NHI) has a designated human owner and a documented business purpose.
- **Zero Trust Architecture**: Implement strict least-privilege policies; restrict the ability to create new service accounts to specific, audited roles.
- **Automated Inventory**: Continuously map NHIs and flag any identity that appears in the directory without a corresponding entry in the Configuration Management Database (CMDB).
- **Hardening**: Restrict `DS-Install-Replica` permissions in Active Directory to prevent unauthorized DCShadow attempts.
## Related Tools/Techniques
- **Synthetic Persona**: Fabricated identities used to deceive *people* (Social Engineering).
- **Golden Ticket / Silver Ticket**: Forging Kerberos tickets for existing accounts.
- **Workload Identity Federation**: Mechanisms often targeted or abused to gain access to cloud resources.