On the internal pentest fintech company, I captured the manager’s session through a stolen session cookie - Use Alternate Authentication Material: Web Session Cookies (T1550.004, Lateral Movement) Twelve minutes later, the session was killed. Not timeout, not logout, not rotation of the token - behavioral analytics engine recorded that the pattern of mouse movements and the rhythm of scrolling do not coincide with the profile of the legitimate user. Twelve minutes was enough for the runaway recon internal endpoints, but for a full-fledged lateral movement - not enough. From that project, I began to systematically analyze how behavioral biometrics works, that it really measures and where it has weaknesses for a red team operator.
How Behavioral Biometrics Is Arranged: Analysis for Red Team
Behaviodic biometrics are passive authentication that works continuously throughout the session. The classic MFA checks the user once with the login and further trusts the session to expiry. Continuous authentication builds a behavioral profile and checks every action with baseline. Vendors like BioCatch protect hundreds of millions of users in the financial sector and process billions of sessions – a scale in which a brimage error is expensive.
Categories of Behavioral Signals
To plan a bypass, you need to know exactly what signals the system collects. For enterprise management, there are five categories of adaptive authentication:
Keystroke dynamics. The time between presses (flight time), the duration of the keyhold (dwell time), the frequency of the typos, the patterns of use of Shift/Ctrl modifiers. Each person has his own "keyboard handwriting" - the most studied and most stable behavioral identifier.
Mouse movement of the mouse (mouse movement of the lifelands). Cursor trajector trajector, speed, acceleration, micromovement when hovering on UI elements. The system fixes not only the target cliques, but also the "path" between them - each operator has its own.
Tachskrin-interaction. On mobile - touch pressure, finger contact area, characteristic swipe gestures. The most complex vector for counterfeiting due to binding to hardware sensors.
handling the device. Accelerometer data and gyroscope: how the user holds a smartphone, angle of inclination, the nature of the tremor. With remote access, it is almost impossible to reproduce.
Navigation Patterns. The order of visiting sections, typical routes by interface, time on each screen. Individually, they are less unique, but in conjunction with physical signals, the accuracy of the model is seriously enhanced.
ML-pipeline: from collection to decision
Architectural behavioral analytics consists of four links. JavaScript agent or mobile SDK collects raw telemetry - mouse coordinates with a frequency of 50-100 Hz, keydown/keyup events with millisecond timings, device sensor data. The feature extraction module highlights the features: medium flight time, standard dwell time deviation, average cursor speed, number of microcorrections.
For each user, a baseline is formed - usually one-class classifier (One-Class SVM, Isolation Forest) or auto encoder trained exclusively on "normal" behavior. In runtime, each telemetry window (30-120 seconds) is chased through the model and generates a risk score.
Three outcomes: Allow (score below the threshold - non-friction pass), Step-up (request for additional verification), Block (complementation of the session and SOC notice). It is this triad that is what red team must be deceived. The task is not to “get a zero score”, but to stay below the step-up threshold long enough to perform the task.
The place of continuous authentication in the attack chain
Continuous authentication is the only protective mechanism that works After successful initial access. The traditional MFA answers the question "who is logging?" once, then trusts the session to expiry. According to CyberMaxx (2025), 60% of phishing incidents use MFA full bypass techniques - primarily AiTM-proxy, intercepting session cookies in real time.
Position in kill chain:
1. Initial Access - phishing with AiTM-proxy, cookie theft via XSS, compromising browser extension. Techniques: Multi-Factor Authentication Interception (T1111, Credential Access), Steal Web Session Cookie (T1539, Credential Access).
2. Foothold - attacking applies Web Session Cookies (T1550,0004, Lateral Action) to enter the application.
3. Post-exploitation - here behavioral analytics is included in the work. Each action in the intercepted session is checked with the profile. Discount -> step-up or kill session.
MFA Request Generation (T1621, Credential Access) combined with AiTM makes the classic MFA inefficient – and that’s why the zero-trust architectures shift the focus to continuous authentication by user behavior.
For a red team-operator, behavioral analytics is the second barrier after EDR/SIEM, but with a fundamental difference: it can not be disable through AMSI bypass or indirect syscals. It works at the app level.
Conceptual example of a Python record pynput:
Python:
from pynput import keyboard
import time, json
events = []
def on_press(key):
events.append({"type": "down", "key": str(key), "ts": time.perf_counter()})
def on_release(key):
events.append({"type": "up", "key": str(key), "ts": time.perf_counter()})
if key == keyboard.Key.esc:
return False listener
with keyboard.Listener(on_press=on_press, on_release=on_release) as l:
l.join()
# json.dump(events, open("profile.json","w"))
Statistics are extracted from the recorded profile: average dwell time, medium flight time for each digraph, standard deviations. When playing, you can not use accurate recorded intervals - you need to add a random jitter within 1-2 standard deviations to mimic natural variability.
When the technique is NOT working: requires prior access to the victim’s workplace (to install the keylogger). On short text inputs (login, search bar) the thresholds of TypingDNA and analogues are so rigid that the jitter does not save. Single-vector replay (but keyboard) is detected by systems with multi-signal fusion through cross-correlation with mouse profile.
Mouse movement biometrics bypass
Mouse movements are a less stable biometric identifier. They are affected by the resolution of the screen, DPI mice, the size of the interface elements. This simultaneously reduces the accuracy of profiling and simplifies the bypass.
The main approach is replay through pyautogui or analogues with recorded trajectories. The problem is the other: behavioral analytics systems track microthreemore (small involuntary oscillations of the cursor), nonlinear acceleration and pauses when making decisions. The software replay generates "too perfect" trajectories - straight lines, constant speed, no corrections. The robot gives itself to its impeccability.
When the technique is NOT working: All serious vendors (BioCatch, BehavioSec) are clearly looking for signs of robotic control. On mobile devices, it is not applicable - the data of the accelerometer is added.
Practical Intelligence: fingerprinting behavioral analytics for targets
Detection methods
JavaScript analysis. In DevTools -> Sources look for scripts with a mass subscription to events mousemove, keydown, keyup, touchstart, scroll. Vendor SDK is loaded from characteristic domains - cdn.biocatch.com, api.typingdna.com, cdn.behaviosec.com. Network-panel will show requests for these hosts.
Frequency of event gathering. In the browser console:
JavaScript:
getEventListeners(document).mousemove?.length // >1 = behavioral tracking
getEventListeners(document).keydown?.length // >1 = keystroke analytics
Behavioral test. Stay out and work for 5-10 minutes normally. Then dramatically change the style - switch to Tab navigation instead of the mouse, change the speed of the set. Step-up challenge in 2-5 minutes is an almost guaranteed indicator of behavioral analytics. I usually start with this before I get in DevTools.
HTTP traffic. In Burp Proxy, track POST queries with volumetric payload containing coordinate or timing arrays. SDK usually sends telemetry packs every 5-30 seconds - fields mouseData, keyEvents, touchEvents, deviceMotion.
Recon through documentation. According to FZ-152, the processing of behavioral data may fall under Article 11 (biometric PD) and require written consent, or carried out on the basis of Article 6 of Part 1 of paragraph 5 (performance of the contract). In practice, the organization mentions a collection in a privacy policy – and it works as an indicator for OSINT.
Restrictions of Technics: What Doesn't Work Against Production Systems
Here you need to be honest - most of the described techniques in a pure form against mature systems do not pass.
BioCatch uses server analysis with the correlation of device fingerprint, geolocation and behavioral telemetry at the same time. The ideal replay of the keyboard profile will fail if the device fingerprint does not coincide. Thousands of parameters are processed in parallel - it is not enough to deceive one vector.
TypingDNA Focuses on keystroke dynamics with cloud-based matching. The thresholds for short inputs (password, OTP) are hard - jitter in 1-2 standard deviations is often lacking. Replay works more reliable on long texts, where statistics average.
Systems with multi-signal fusion (BehavioSec and analogues) - single-vector replay (only the keyboard or only mouse) is detected through cross-correlation of channels. If the keystroke profile has more common and the mouse profile is not, it is a strong signal of user behavior.
Mobile applications - data of the accelerometer and gyroscope cannot be forged with remote access. This vector remains impenetrable for remote operations. There's no options.
How Behavioral Biometrics Is Arranged: Analysis for Red Team
Behaviodic biometrics are passive authentication that works continuously throughout the session. The classic MFA checks the user once with the login and further trusts the session to expiry. Continuous authentication builds a behavioral profile and checks every action with baseline. Vendors like BioCatch protect hundreds of millions of users in the financial sector and process billions of sessions – a scale in which a brimage error is expensive.
Categories of Behavioral Signals
To plan a bypass, you need to know exactly what signals the system collects. For enterprise management, there are five categories of adaptive authentication:
Keystroke dynamics. The time between presses (flight time), the duration of the keyhold (dwell time), the frequency of the typos, the patterns of use of Shift/Ctrl modifiers. Each person has his own "keyboard handwriting" - the most studied and most stable behavioral identifier.
Mouse movement of the mouse (mouse movement of the lifelands). Cursor trajector trajector, speed, acceleration, micromovement when hovering on UI elements. The system fixes not only the target cliques, but also the "path" between them - each operator has its own.
Tachskrin-interaction. On mobile - touch pressure, finger contact area, characteristic swipe gestures. The most complex vector for counterfeiting due to binding to hardware sensors.
handling the device. Accelerometer data and gyroscope: how the user holds a smartphone, angle of inclination, the nature of the tremor. With remote access, it is almost impossible to reproduce.
Navigation Patterns. The order of visiting sections, typical routes by interface, time on each screen. Individually, they are less unique, but in conjunction with physical signals, the accuracy of the model is seriously enhanced.
ML-pipeline: from collection to decision
Architectural behavioral analytics consists of four links. JavaScript agent or mobile SDK collects raw telemetry - mouse coordinates with a frequency of 50-100 Hz, keydown/keyup events with millisecond timings, device sensor data. The feature extraction module highlights the features: medium flight time, standard dwell time deviation, average cursor speed, number of microcorrections.
For each user, a baseline is formed - usually one-class classifier (One-Class SVM, Isolation Forest) or auto encoder trained exclusively on "normal" behavior. In runtime, each telemetry window (30-120 seconds) is chased through the model and generates a risk score.
Three outcomes: Allow (score below the threshold - non-friction pass), Step-up (request for additional verification), Block (complementation of the session and SOC notice). It is this triad that is what red team must be deceived. The task is not to “get a zero score”, but to stay below the step-up threshold long enough to perform the task.
The place of continuous authentication in the attack chain
Continuous authentication is the only protective mechanism that works After successful initial access. The traditional MFA answers the question "who is logging?" once, then trusts the session to expiry. According to CyberMaxx (2025), 60% of phishing incidents use MFA full bypass techniques - primarily AiTM-proxy, intercepting session cookies in real time.
Position in kill chain:
1. Initial Access - phishing with AiTM-proxy, cookie theft via XSS, compromising browser extension. Techniques: Multi-Factor Authentication Interception (T1111, Credential Access), Steal Web Session Cookie (T1539, Credential Access).
2. Foothold - attacking applies Web Session Cookies (T1550,0004, Lateral Action) to enter the application.
3. Post-exploitation - here behavioral analytics is included in the work. Each action in the intercepted session is checked with the profile. Discount -> step-up or kill session.
MFA Request Generation (T1621, Credential Access) combined with AiTM makes the classic MFA inefficient – and that’s why the zero-trust architectures shift the focus to continuous authentication by user behavior.
For a red team-operator, behavioral analytics is the second barrier after EDR/SIEM, but with a fundamental difference: it can not be disable through AMSI bypass or indirect syscals. It works at the app level.
Conceptual example of a Python record pynput:
Python:
from pynput import keyboard
import time, json
events = []
def on_press(key):
events.append({"type": "down", "key": str(key), "ts": time.perf_counter()})
def on_release(key):
events.append({"type": "up", "key": str(key), "ts": time.perf_counter()})
if key == keyboard.Key.esc:
return False listener
with keyboard.Listener(on_press=on_press, on_release=on_release) as l:
l.join()
# json.dump(events, open("profile.json","w"))
Statistics are extracted from the recorded profile: average dwell time, medium flight time for each digraph, standard deviations. When playing, you can not use accurate recorded intervals - you need to add a random jitter within 1-2 standard deviations to mimic natural variability.
When the technique is NOT working: requires prior access to the victim’s workplace (to install the keylogger). On short text inputs (login, search bar) the thresholds of TypingDNA and analogues are so rigid that the jitter does not save. Single-vector replay (but keyboard) is detected by systems with multi-signal fusion through cross-correlation with mouse profile.
Mouse movement biometrics bypass
Mouse movements are a less stable biometric identifier. They are affected by the resolution of the screen, DPI mice, the size of the interface elements. This simultaneously reduces the accuracy of profiling and simplifies the bypass.
The main approach is replay through pyautogui or analogues with recorded trajectories. The problem is the other: behavioral analytics systems track microthreemore (small involuntary oscillations of the cursor), nonlinear acceleration and pauses when making decisions. The software replay generates "too perfect" trajectories - straight lines, constant speed, no corrections. The robot gives itself to its impeccability.
When the technique is NOT working: All serious vendors (BioCatch, BehavioSec) are clearly looking for signs of robotic control. On mobile devices, it is not applicable - the data of the accelerometer is added.
Practical Intelligence: fingerprinting behavioral analytics for targets
Detection methods
JavaScript analysis. In DevTools -> Sources look for scripts with a mass subscription to events mousemove, keydown, keyup, touchstart, scroll. Vendor SDK is loaded from characteristic domains - cdn.biocatch.com, api.typingdna.com, cdn.behaviosec.com. Network-panel will show requests for these hosts.
Frequency of event gathering. In the browser console:
JavaScript:
getEventListeners(document).mousemove?.length // >1 = behavioral tracking
getEventListeners(document).keydown?.length // >1 = keystroke analytics
Behavioral test. Stay out and work for 5-10 minutes normally. Then dramatically change the style - switch to Tab navigation instead of the mouse, change the speed of the set. Step-up challenge in 2-5 minutes is an almost guaranteed indicator of behavioral analytics. I usually start with this before I get in DevTools.
HTTP traffic. In Burp Proxy, track POST queries with volumetric payload containing coordinate or timing arrays. SDK usually sends telemetry packs every 5-30 seconds - fields mouseData, keyEvents, touchEvents, deviceMotion.
Recon through documentation. According to FZ-152, the processing of behavioral data may fall under Article 11 (biometric PD) and require written consent, or carried out on the basis of Article 6 of Part 1 of paragraph 5 (performance of the contract). In practice, the organization mentions a collection in a privacy policy – and it works as an indicator for OSINT.
Restrictions of Technics: What Doesn't Work Against Production Systems
Here you need to be honest - most of the described techniques in a pure form against mature systems do not pass.
BioCatch uses server analysis with the correlation of device fingerprint, geolocation and behavioral telemetry at the same time. The ideal replay of the keyboard profile will fail if the device fingerprint does not coincide. Thousands of parameters are processed in parallel - it is not enough to deceive one vector.
TypingDNA Focuses on keystroke dynamics with cloud-based matching. The thresholds for short inputs (password, OTP) are hard - jitter in 1-2 standard deviations is often lacking. Replay works more reliable on long texts, where statistics average.
Systems with multi-signal fusion (BehavioSec and analogues) - single-vector replay (only the keyboard or only mouse) is detected through cross-correlation of channels. If the keystroke profile has more common and the mouse profile is not, it is a strong signal of user behavior.
Mobile applications - data of the accelerometer and gyroscope cannot be forged with remote access. This vector remains impenetrable for remote operations. There's no options.
