Shadow Linking: The Persistence Vector of SaaS Identity Threat
Abuse of additional identity providers to persist in an environment.
- from
- Malware Persistence
- added
- 2026-10-10
- likes
- 0
similar
-
Persisting on Entra ID applications and User Managed Identities with Federated Credentials dirkjanm.io
Persist on Entra ID applications and User Managed Identities with Federated Credentials.
-
Persistence – COM Hijacking, 2020 pentestlab.blog
-
Untangling Kovter's persistence methods blog.malwarebytes.com
Blog post about Kovter's persistens methos, among others, hiding in registry. Another one is Threat Spotlight: Kovter Malware Fileless Persistence Mechanism.
-
Common malware persistence mechanisms resources.infosecinstitute.com
Different persistence mechanisms for different vectors are described.
-
Malware persistence techniques andreafortuna.org
Good summary of multiple persistence mechanisms, ranging from multiple registry keys to more advanced one, like COM hijacking.
-
SAML: A Fractal of Bad Design blog.trailofbits.com
“SAML is being crushed under the weight of its own complexity.” The author lists five flaws that compound: “1. Built on XML; 2. Canonicalization; 3. Enveloped signatures; 4. 'Kitchen-sink' design; 5. Ossification.” So instead of one more mitigation, identity providers get a…
Malware Persistence › Techniques > Cloud: “Abuse of additional identity providers to persist in an environment.”