Confused deputy
Tricking something that holds a privilege into using it for you.
An old idea and an exact description of what an agent is. The agent holds your credentials and your access. An attacker who cannot use those directly only needs to persuade the agent to use them, and the agent has no way to know it was persuaded.
Every audit log will show your own account doing the thing, at a normal time, in a normal way. That is the part which makes it expensive after the fact.
It explains why identity-based controls do not help much here. The request really does come from you.
Looking for the attacker's identity in the logs. There is not one. What you are looking for is a legitimate action nobody asked for.
Related terms
See Confused deputy on a real listing
Every term here shows up in the catalogue next to a real result, with the findings published and the limits stated. Free to browse, no account needed.
Open the catalogue