Identity threats and ITDR, by ear

Introduces identity threat detection and response from the view of hands-on identity teams and where organizations struggle most.

Explains why attackers now target identity systems as an entry point, what ITDR tools do, and why identity and security operations teams must cooperate.

Discusses ITDR as an emerging category and how it differs from traditional identity and access management controls.

What MFA fatigue is: an attacker with a stolen password floods push prompts until the user approves, why it worked against Uber and Cisco, and why users should question unexpected prompts.

Breaks down the 2023 MGM help desk social engineering attack and the Okta support system breach, and the identity weaknesses both exploited.

Dissects the Midnight Blizzard (APT29) breach of Microsoft, including password spraying a legacy test tenant and abusing OAuth applications for access.

Explains why attackers moved from stealing passwords to hijacking session tokens and cookies, and why the browser is now a main identity attack surface.

Summarizes seven Q1 2026 threat reports and the identity patterns they share, including MFA gaps, machine identity abuse, deepfakes, and faster breach timelines.

A Microsoft incident responder walks the attack kill chain from initial access to ransomware extortion and shares ways to reduce identity risk.

How Kerberoasting abuses RC4 service tickets, why old service account keys stay RC4 until reset, and a defender to-do list: audit RC4, disable it, gMSAs, SPN cleanup.

How Octo Tempest (Scattered Spider) uses SIM swaps, SMS phishing and help desk password and MFA reset calls backed by stolen PII, and defenses such as strict reset verification and phishing-resistant MFA.

Explains how attackers escalate through identity infrastructure after initial access, and why identity defense needs a recovery-first plan as well as prevention.

A security researcher explains how Conditional Access can be bypassed through FOCI client apps, pre-consented scopes and policy exclusions, and what admins can do about it.

Covers Entra ID attack research: backdooring service principals, restricted administrative units that create undeletable accounts, AppLock bypass, and Copilot Studio OAuth phishing.

Separates real ITDR capability from vendor relabeling, contrasts visibility with observability of identity behavior, and argues hygiene must come before detection.