Attackers have learned that logging in is easier than breaking in. Rather than exploiting software vulnerabilities, many intrusions now rely on stolen credentials, hijacked sessions, abused service accounts, and manipulation of identity infrastructure such as Active Directory and cloud identity providers. Traditional endpoint and network tools often see these actions as legitimate activity by a valid user.
Identity Threat Detection and Response (ITDR) is the security discipline built to close that gap. This article explains what ITDR is, the attacks it detects, how it relates to EDR, XDR, and SIEM, and how to build ITDR capability in your organization.
What Is Identity Threat Detection and Response?
ITDR is a set of tools, processes, and practices focused on protecting identity infrastructure and detecting and responding to attacks that use or target identities. The term was popularized by Gartner in 2022, reflecting a shift in how attackers operate.
ITDR covers three broad areas:
- Identity posture: finding weaknesses in identity systems before attackers do, such as excessive privileges, risky configurations, stale accounts, and weak authentication.
- Detection: identifying suspicious identity behavior and known identity attack techniques in real time.
- Response: containing compromised identities quickly by revoking sessions, resetting credentials, disabling accounts, and blocking risky access.
It sits alongside identity and access management (IAM) and privileged access management (PAM). IAM and PAM control who should have access; ITDR watches whether that access is being abused.
Why ITDR Matters Now
- Credential-based attacks dominate. Phishing, credential stuffing, infostealer malware, and MFA bypass techniques put valid credentials in attackers’ hands.
- Identity is the new perimeter. Cloud and SaaS adoption mean identity providers now gate access to almost everything. Our guide to Zero Trust for cloud environments explains why.
- Identity infrastructure is a high-value target. Compromising Active Directory or a cloud identity tenant can give attackers control of the entire environment.
- Social engineering of help desks. Groups such as the one CISA and the FBI described in their advisory on Scattered Spider have used help desk impersonation and MFA manipulation to gain access to large organizations.
- Traditional tools miss it. An attacker using a valid account looks normal to many controls unless identity behavior is analyzed in context.
Identity Attacks ITDR Is Designed to Detect
| Attack | What Happens | Typical Signals |
|---|---|---|
| Credential stuffing and password spraying | Automated login attempts using leaked or common passwords | Many failed logins across accounts, unusual source IPs |
| MFA fatigue and MFA manipulation | Repeated push prompts or attacker-registered MFA devices | Bursts of MFA denials, new MFA method registered after reset |
| Session and token theft | Stolen cookies or tokens replayed to bypass login | Same session used from different locations or devices |
| Kerberoasting | Requesting service tickets to crack service account passwords offline | Unusual volume of service ticket requests with weak encryption types |
| Pass-the-hash and pass-the-ticket | Reusing stolen credential material without knowing the password | Authentication anomalies, unusual logon types |
| DCSync | Impersonating a domain controller to extract password hashes | Replication requests from non-domain-controller hosts |
| Golden and silver tickets | Forged Kerberos tickets granting persistent access | Ticket anomalies, suspicious lifetimes or encryption |
| Privilege escalation via misconfiguration | Abusing excessive rights or group nesting to gain admin | Unexpected changes to privileged groups or permissions |
| Malicious OAuth consent and app abuse | Tricking users into granting a malicious app access to mail or files | New high-privilege app consents, unusual API access |
| Help desk social engineering | Attacker convinces support to reset credentials or MFA | Reset followed quickly by new device and unusual activity |
Many of these techniques are catalogued in MITRE ATT&CK under credential access, privilege escalation, and lateral movement, which provides a useful reference for detection engineering.
ITDR vs EDR, XDR, and SIEM
| Capability | Primary Focus | Identity Coverage |
|---|---|---|
| EDR | Endpoint processes, files, and behavior | Limited; sees credential theft tools on endpoints but not identity system abuse |
| SIEM | Log collection, correlation, and alerting | Depends on which identity logs are ingested and how rules are written |
| XDR | Correlated detection across endpoint, network, email, cloud | Growing, often with identity modules |
| ITDR | Identity infrastructure, authentication, and authorization behavior | Deep; purpose-built for identity attacks and posture |
ITDR doesn’t replace these tools; it complements them. Identity alerts are most valuable when correlated with endpoint and network evidence in the SOC. For a broader comparison of detection technologies, see our article on SIEM vs XDR vs MDR.
Core Capabilities of an ITDR Program
1. Identity Attack Surface Assessment
Continuously identify risky conditions: privileged accounts without MFA, stale accounts, service accounts with weak or non-expiring passwords, dangerous delegation settings, excessive group membership, and cloud roles with broad permissions.
2. Real-Time Detection
Monitor authentication logs, directory changes, token issuance, and identity provider events. Combine signature-based detections for known techniques with behavioral analytics that flag unusual activity for a given user or service.
3. Deception
Some programs plant honey accounts or decoy credentials that legitimate users never touch. Any use is a high-fidelity sign of an attacker.
4. Automated and Guided Response
Speed matters with compromised identities. Response playbooks should be able to revoke sessions and tokens, force credential resets, disable accounts, remove newly added MFA methods, and block risky sign-ins, with human approval where appropriate.
5. Integration With the SOC
Identity alerts should flow into the same triage and investigation workflow as other detections, so analysts can see whether a suspicious login was followed by unusual endpoint or data activity. A managed detection and response service can provide this around the clock.
How to Build ITDR Capability
- Map your identity estate. Include on-premises directories, cloud identity providers, SaaS applications, privileged accounts, service accounts, and machine identities.
- Harden first. Fix the most dangerous posture issues: enforce phishing-resistant MFA for privileged users, remove unnecessary admin rights, rotate service account credentials, and disable legacy authentication. Our article on why MFA is no longer optional covers authentication basics.
- Centralize identity telemetry. Collect directory logs, authentication events, MFA events, and identity provider audit logs in your SIEM or ITDR platform.
- Deploy detections for priority techniques. Start with credential spraying, MFA manipulation, privileged group changes, DCSync, and Kerberoasting.
- Write response playbooks. Define who can revoke sessions, disable accounts, and reset credentials, and how quickly.
- Secure the help desk. Strengthen identity verification for password and MFA resets, especially for privileged users.
- Test regularly. Use red team assessments and assumed-breach testing to validate that identity attacks are detected and contained.
- Measure and improve. Track time to detect and contain identity compromise, privileged accounts with weak authentication, and posture issues closed over time.
Common Mistakes
- Focusing only on cloud identity while on-premises Active Directory remains the path to domain compromise, or the reverse.
- Ignoring service accounts and non-human identities, which often have high privileges and little monitoring.
- Alert without action. Detecting a compromised account is of limited value if revoking access takes hours.
- Weak help desk processes that undo strong authentication controls.
- Treating ITDR as a tool purchase rather than a combination of posture management, detection engineering, and response.
Securis360’s 24×7 security operations center includes identity-focused monitoring and response, and our article on threat hunting explains how proactive searches complement automated identity detections.
Example: How ITDR Contains an Identity Attack
Consider a realistic scenario. An attacker phishes a finance employee using an adversary-in-the-middle kit and captures a valid session token.
- Detection: the identity platform notices the same session being used from a new country and an unfamiliar device minutes after a legitimate sign-in, and raises a high-severity alert.
- Correlation: the SOC sees that the session has just created a mailbox forwarding rule and accessed payment-related files, confirming malicious intent.
- Response: an automated playbook revokes all sessions and refresh tokens for the user, removes the forwarding rule, forces re-registration of MFA with help desk verification, and blocks the source IP range.
- Investigation: analysts review what the attacker accessed, check for new OAuth app consents, and search for the same indicators across other accounts.
- Improvement: the organization moves finance users to phishing-resistant passkeys and adds a conditional access rule requiring a compliant device for finance applications.
Without identity-focused detection, this intrusion might only have been noticed when a fraudulent payment was made. With ITDR, it was contained within minutes and used to strengthen controls.
Frequently Asked Questions
What does ITDR stand for?
ITDR stands for Identity Threat Detection and Response, a discipline focused on detecting and responding to attacks that target or use identities and identity infrastructure.
How is ITDR different from IAM?
IAM manages who has access and how they authenticate. ITDR monitors whether identities and identity systems are being attacked or abused and helps respond when they are.
Do we need ITDR if we already have EDR and a SIEM?
EDR and SIEM provide valuable coverage, but many identity attacks don’t generate obvious endpoint signals. ITDR capabilities, whether a dedicated platform or well-engineered SIEM detections, fill that gap.
Does ITDR protect cloud identity providers as well as Active Directory?
A complete ITDR approach covers both on-premises directories and cloud identity platforms, plus SaaS applications and machine identities.
What is the first step toward ITDR?
Start with an identity posture assessment and fix high-risk issues such as privileged accounts without phishing-resistant MFA, then centralize identity logs and deploy detections for the most common attack techniques.
Key Takeaways
- Attackers increasingly log in with stolen or abused identities rather than exploiting software.
- ITDR combines identity posture management, detection, and rapid response.
- It complements EDR, SIEM, and XDR by focusing on identity infrastructure and behavior.
- Harden identities first, then detect, respond, and test continuously.