Why identity needs its own detection
When an attacker uses a real account, endpoint and network tools may see nothing unusual. The signal is in how the account behaves compared with its history and its peers.
Events to collect
Start with sources that exist in most environments.
- Sign-in events, including failures, multi-factor challenges and source locations.
- Privilege changes: additions to administrative groups, new roles and delegated rights.
- Directory events on domain controllers, such as unusual authentication requests.
- Creation and modification of service accounts, application registrations and tokens.
Patterns worth alerting on
Prioritise combinations over single events. A new device followed by a mailbox rule and a privilege change deserves more attention than any one of them alone. Tune against a baseline of normal administrator activity so that real maintenance does not drown the alerts.
Reduce what there is to defend
Detection works better when there are fewer privileged accounts. Review standing administrator rights regularly, remove unused service accounts and prefer time-limited elevation over permanent membership.