Identity Threat Detection and Response (ITDR): building detection capability

What is Identity Threat Detection and Response?

Attackers bypass network security entirely by compromising identity systems directly — Active Directory, cloud identity providers, privileged access management platforms, and federated authentication services. Once inside these systems, they appear as legitimate users while escalating privileges and accessing sensitive data for months without detection. Identity Threat Detection and Response (ITDR) detects and responds to attacks targeting identity infrastructure through behavioral analysis and anomaly detection.

ITDR operates as a detection discipline focused on identity attack patterns, distinct from Identity Security Posture Management (ISPM), which addresses configuration risks and compliance gaps. Where ISPM identifies misconfigurations like overprivileged accounts or weak password policies, ITDR hunts for active threats exploiting those weaknesses.

The capability integrates with existing SIEM and SOAR platforms to correlate identity events across on-premises and cloud environments. Detection coverage spans authentication anomalies, authorization changes, credential usage patterns, and directory service modifications.

Why Identity Threat Detection and Response matters

Traditional network security controls fail to detect lateral movement techniques like pass-the-hash, golden ticket attacks, and DCSync operations because this activity appears as legitimate authentication traffic. Endpoint detection misses cloud-based identity attacks entirely, creating visibility gaps for hybrid and multi-cloud environments.

The business consequence: attackers dwell undetected for months, escalating privileges and accessing sensitive data while appearing as authorized users. ITDR capabilities establish identity baselines and alert on deviations from normal authentication patterns, exposing these otherwise invisible attacks.

Detection without response creates alert fatigue and delayed incident containment. Automated response capabilities reduce manual investigation overhead but increase risk of legitimate user disruption during false positive events.

Attack surfaces and threat vectors

On-premises Active Directory

Domain controllers serve as high-value targets for attackers seeking to compromise entire Windows environments. DCSync attacks allow authenticated users to request password hashes for any domain account by impersonating domain controllers. Golden ticket attacks leverage compromised KRBTGT account hashes to forge Kerberos tickets granting unlimited domain access.

Shadow credentials attacks abuse Key Trust authentication by adding attacker-controlled certificates to user or computer objects, enabling authentication without password knowledge. Attackers exploit Silver Ticket attacks to forge service tickets for specific resources after compromising service account passwords.

Cloud identity platforms

OAuth token theft enables attackers to maintain persistent access to cloud applications without password authentication. Token replay attacks exploit stolen refresh tokens to generate new access tokens, bypassing multi-factor authentication requirements.

Consent grant attacks trick users into authorizing malicious applications with excessive permissions, granting attackers access to email, files, and calendar data. Device registration abuse allows attackers to register rogue devices as trusted endpoints, bypassing conditional access policies.

Privileged Access Management

PAM vault compromises provide attackers with credentials for critical infrastructure systems, service accounts, and administrative consoles. Session recording bypass techniques help attackers avoid detection during privileged access sessions.

Emergency access abuse exploits break-glass procedures designed for disaster recovery, providing attackers with unrestricted administrative privileges when standard controls fail.

Detection guidance

Authentication anomaly detection

Monitor for impossible travel patterns where user accounts authenticate from geographically distant locations within impossible timeframes:

-- Impossible Travel Detection (Splunk)
index=authentication earliest=-24h
| eval src_location=iplocation(src_ip)
| eval dest_location=iplocation(dest_ip)
| eval distance=geodist(src_lat, src_lon, dest_lat, dest_lon)
| eval travel_time=(_time - previous_login_time)
| eval min_travel_time=(distance / 800) * 3600
| where travel_time < min_travel_time AND travel_time > 0
| table user, src_location, dest_location, distance, travel_time

Track bulk authentication failures indicating password spraying campaigns:

// Password Spray Detection (Sentinel)
SigninLogs
| where TimeGenerated >= ago(1h)
| where ResultType == "50126" // Invalid username or password
| summarize FailedAttempts = count(), UniqueIPs = dcount(IPAddress), 
 UniqueUserAgents = dcount(UserAgent) by UserPrincipalName
| where FailedAttempts >= 5 and UniqueIPs >= 3
| project UserPrincipalName, FailedAttempts, UniqueIPs, UniqueUserAgents

Privilege escalation monitoring

Detect unusual privilege assignments and group membership changes:

-- Privilege Escalation Detection (Elastic)
event.category:"iam" AND event.action:("group-member-added" OR "role-assigned")
| eval is_admin_group = if(match(group_name, "(?i)(admin|root|domain admin|enterprise admin)"), 1, 0)
| eval is_service_account = if(match(user_name, "(?i)(svc|service|$)"), 1, 0)
| where is_admin_group == 1 AND is_service_account == 0
| stats count by user_name, group_name, src_ip

Monitor for DCSync attack patterns in Windows Event Logs:

-- DCSync Detection (Windows Events)
source="WinEventLog:Security" EventCode=4662
| eval object_properties=mvindex(split(Properties, ","), 0)
| where match(object_properties, "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2|1131f6ad-9c07-11d1-f79f-00c04fc2dcd2")
| eval is_dc = if(match(Computer_Name, "(?i)DCd+"), 1, 0)
| where is_dc != 1
| table _time, Account_Name, Computer_Name, Object_Name

Token and certificate abuse

Identify OAuth consent grant attacks through application permission analysis:

// Suspicious OAuth Consent (Azure)
AuditLogs
| where ActivityDisplayName == "Consent to application"
| extend AppName = tostring(TargetResources[0].displayName)
| extend Permissions = tostring(AdditionalDetails[2].value)
| where Permissions has_any("Mail.Read", "Files.Read.All", "Directory.Read.All")
| project TimeGenerated, UserPrincipalName, AppName, Permissions, IPAddress

Detect certificate-based authentication anomalies:

-- Shadow Credentials Detection (AD Events)
source="WinEventLog:Security" EventCode=5136
| where AttributeLDAPDisplayName="msDS-KeyCredentialLink"
| eval action=if(match(AttributeValue, "B:0"), "removed", "added")
| where action="added"
| table _time, SubjectUserName, ObjectDN, AttributeValue

Dormant account reactivation

Monitor previously inactive accounts for suspicious authentication activity:

-- Dormant Account Alert (Generic SIEM)
index=authentication
| eval days_since_last_login = (now() - last_login_time) / 86400
| where days_since_last_login > 90 AND current_login_success = 1
| eval risk_score = case(
 days_since_last_login > 365, 3,
 days_since_last_login > 180, 2,
 1
)
| table user, days_since_last_login, src_ip, risk_score

Required log sources

ITDR detection requires comprehensive log collection from identity infrastructure components. Windows Security Event Logs provide authentication events, privilege changes, and directory modifications. Azure Active Directory Sign-in Logs capture cloud authentication attempts, conditional access decisions, and risk events.

Domain controller logs expose Kerberos ticket requests, LDAP queries, and replication traffic necessary for detecting advanced AD attacks. Cloud application audit logs reveal OAuth token usage, API access patterns, and application consent events.

DHCP and DNS logs provide network context for correlating authentication events with endpoint activity. VPN and remote access logs establish baseline patterns for detecting compromised remote access credentials.

Mitigation strategies

Immediate response actions

Automated account lockout provides rapid containment for compromised credentials but risks disrupting legitimate users during false positive events. Containment speed versus business continuity impact becomes the primary decision.

Token revocation immediately invalidates compromised OAuth tokens and forces reauthentication through multi-factor controls. Session termination disconnects active sessions associated with suspicious authentication events.

Identity hardening controls

Privileged Access Workstations (PAWs) isolate administrative activities from standard user environments, limiting credential exposure during compromise events. Just-in-time access reduces the attack window by granting elevated privileges only when needed.

Conditional access policies enforce device compliance, location restrictions, and multi-factor authentication based on risk signals. Certificate-based authentication eliminates password-based attacks but requires public key infrastructure management.

Detection tuning requirements

Baseline establishment requires 30-90 days of normal activity data to distinguish legitimate behavior from anomalous patterns. User behavior analytics models typical authentication patterns, application usage, and resource access for each identity.

Alert correlation rules should combine multiple weak signals to reduce false positive rates while maintaining detection coverage. The operational consideration: overly sensitive thresholds generate alert fatigue while conservative settings miss sophisticated attacks.

Risk scoring frameworks can prioritize alerts based on user privilege levels, data sensitivity, and attack technique severity. Integration with threat intelligence feeds enhances detection accuracy by incorporating known IoCs and attack patterns.

Response playbook integration

SOAR integration enables automated evidence collection, timeline reconstruction, and impact assessment during identity-based incidents. Playbooks should define escalation criteria, containment procedures, and recovery steps for different attack scenarios.

Forensic preservation captures relevant logs, memory dumps, and authentication artifacts before containment actions modify system state. Communication templates prepare stakeholder notifications and regulatory disclosures for data breach scenarios.

ITDR implementation checklist

Signal source integration

Baseline establishment

Detection rule coverage

Alert triage process

Response playbook requirements