cyber.hendryadrian.com
Interesting Stuff · huntress.com

How ITDR Detects and Responds to Identity-Based Attacks

· Original article ↗

Summary

The guide explains how ITDR monitors identity activity for suspicious logins, account takeover, token persistence and privilege abuse, and can revoke sessions or disable accounts. It also cites Huntress-reported identity and ransomware precursor statistics.

Key points

  • ITDR monitors login, authentication and directory activity to identify suspicious behavior after an account is accessed.
  • Potential signals include unusual logins, session hijacking, malicious inbox rules, rogue OAuth applications and privilege abuse.
  • Possible responses include revoking sessions, removing malicious rules, disabling compromised accounts or locking credentials.
  • The article describes combining telemetry and analytics with analyst review and, in some cases, automated remediation; its account-locking example is illustrative.
  • It distinguishes ITDR's focus on identity threats from IAM's access controls and the broader endpoint, network and cloud coverage of MDR and XDR.
  • Huntress reports that 37% of identity threats it tracked involved logins with a suspicious footprint; it says identity-related precursor activity appeared in about 17% of ransomware incidents at least seven days before deployment, and nearly 21% within 14 days.
  • The guide recommends evaluating where identity threats may occur, available security expertise, response capabilities and integration with existing tools.

Article Details

Topic
Overview of Identity Threat Detection and Response (ITDR), its capabilities, benefits, and relationship to IAM, XDR, and MDR.

Vendors

HuntressHuntress Managed ITDR is powered by expert human threat hunters, giving Huntress the ability to deliver enterprise-grade identity protection that your business can trust.

Products

Google WorkspaceHuntress Managed ITDR for Microsoft 365 and Google WorkspaceHuntress Managed EDRYes, when Managed ITDR is deployed alongside Huntress Managed EDR.Huntress Managed ITDRHuntress Managed ITDR is powered by expert human threat hunters, giving Huntress the ability to deliver enterprise-grade identity protection that your business can trust.Microsoft 365 Apps for EnterpriseHuntress Managed ITDR for Microsoft 365 and Google Workspace

Related Articles