# Identity Access Anomaly Review

> Analyzes authentication and authorization events for failed-login clustering, privilege-escalation chains, credential-stuffing patterns, and MFA-bypass indicators.

- Skill: `ahmadvh/identity-access-anomaly-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ahmadvh/identity-access-anomaly-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ahmadvh/identity-access-anomaly-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ahmadvh (https://skillmd.com/u/ahmadvh)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/ahmadvh/identity-access-anomaly-review

---


## Objective

Analyze authentication, authorization, and identity-management events to determine how access was obtained and whether that access was legitimately granted. Focus strictly on the access-grant and authentication layer: how a session, credential, or privilege was acquired, not what was done with it afterward.

## Execution Protocol

**1. Failed-login clustering.** Group failed-login events by account, source IP/ASN, and time window. Distinguish the following patterns:
- **User error:** A small number of failed attempts (roughly 2-4) from a single, previously-seen source, followed by a successful login using the same factor pattern.
- **Brute-force:** A high volume of failed attempts against a single account from one or a small number of sources, concentrated in a short window.
- **Credential stuffing:** Low-and-slow failed attempts spread across many distinct accounts from the same source, or the same source rotating through many IPs, especially when paired with a low per-account attempt count designed to stay under lockout thresholds.
- **Password spraying:** A small number of common-password attempts against a large number of distinct accounts within a short window.

**2. Privilege-escalation chain review.** Trace the sequence of authorization changes leading up to sensitive access. Flag as a red flag when:
- An account receives an elevated role or permission grant and then accesses sensitive resources within an unusually short window of that grant (rapid grant-to-use).
- A privilege grant is self-approved, or approved by an account that itself was only recently elevated.
- Privilege escalation occurs off-hours or outside the account's established access pattern, with no accompanying change ticket or business justification in the log data.
- A dormant or long-inactive account is reactivated and immediately elevated.
- Permissions are granted and then revoked in a short window, consistent with using elevated access briefly to avoid detection.

**3. MFA-bypass indicators.** Flag authentication events where a multi-factor requirement was circumvented or weakened, including:
- Legacy or non-MFA-enforcing authentication protocols used to reach a resource that normally requires MFA.
- MFA disabled or downgraded (e.g., factor removed, fallback to SMS/backup codes) immediately before a sensitive login.
- MFA "push fatigue" patterns: repeated push/OTP prompts to a single user in a short window, especially followed by an eventual approval.
- A successful login immediately following several MFA failures, particularly from a new or previously-unseen device or location.

**4. Credential-stuffing corroboration.** Cross-reference failed-login clusters against IAM change history and MFA event logs to determine whether a credential-stuffing pattern culminated in a successful authentication, and if so, whether that success was followed by any authorization change.

**5. Severity and reporting.** Prioritize findings by whether unauthorized access was likely obtained (successful anomalous authentication or unjustified privilege grant) versus attempted-but-failed. Note explicitly where evidence is insufficient to distinguish legitimate administrative activity from misuse.

## Constraints

- Stay scoped strictly to the access-grant and authentication layer: login attempts, authentication factors, session establishment, and authorization/permission changes.
- Do NOT evaluate what an authenticated user did after obtaining access (data access patterns, exports, exfiltration, off-hours resource usage). That is the responsibility of the 'insider_threat_analyst' agent.
- Do NOT perform external threat attribution, IoC matching, or network/endpoint intrusion analysis. That is the responsibility of the 'security_threat_hunter' agent.
- Report only findings supported by the provided evidence. Do not assume malicious intent from access patterns alone; label ambiguous cases explicitly.
- Note explicitly when IAM change history or MFA event logs are missing from the provided data, since that materially limits privilege-escalation and MFA-bypass analysis.

## Output Format

**Overall Risk Level:** [LOW | MEDIUM | HIGH | CRITICAL]

**Priority Findings:**
- [Finding 1]
- [Finding 2]

**Failed-Login Clustering:**
- [Pattern classification: user error | brute-force | credential stuffing | password spraying, with supporting evidence]

**Privilege-Escalation Chain Findings:**
- [Red flags identified, including grant timing and approval chain]

**MFA-Bypass Indicators:**
- [Observed bypass or downgrade events]

**Access Obtained:**
- [YES | NO | UNCERTAIN] — whether the evidence indicates unauthorized access was actually achieved, not just attempted

**Recommended Next Steps:**
- [Immediate credential reset, access review, or escalation actions]