Identity threats and ITDR, by ear

Introduces identity threat detection and response from the view of hands-on identity teams and where organizations struggle most.

Explains why attackers now target identity systems as an entry point, what ITDR tools do, and why identity and security operations teams must cooperate.

Discusses ITDR as an emerging category and how it differs from traditional identity and access management controls.

Explains session cookie hijacking, how stolen cookies let attackers skip MFA, and why the technique grew through 2022.

Breaks down the 2023 MGM help desk social engineering attack and the Okta support system breach, and the identity weaknesses both exploited.

Dissects the Midnight Blizzard (APT29) breach of Microsoft, including password spraying a legacy test tenant and abusing OAuth applications for access.

Explains why attackers moved from stealing passwords to hijacking session tokens and cookies, and why the browser is now a main identity attack surface.

News discussion of the 2024 Snowflake customer breaches, where stolen credentials against accounts without mandatory MFA led to mass data theft.

Summarizes seven Q1 2026 threat reports and the identity patterns they share, including MFA gaps, machine identity abuse, deepfakes, and faster breach timelines.

A Microsoft incident responder walks the attack kill chain from initial access to ransomware extortion and shares ways to reduce identity risk.

Explains how attackers escalate through identity infrastructure after initial access, and why identity defense needs a recovery-first plan as well as prevention.

What Tier 0 assets are, how attack paths through Active Directory lead to them, and how to manage those paths in hybrid AD environments.

Includes a promotion of the publisher's own product.

A red teamer shows how attackers bypass Entra Conditional Access through FOCI client families and token endpoint gaps, and how to harden policies.

Covers Entra ID attack research: backdooring service principals, restricted administrative units that create undeletable accounts, AppLock bypass, and Copilot Studio OAuth phishing.

Separates real ITDR capability from vendor relabeling, contrasts visibility with observability of identity behavior, and argues hygiene must come before detection.