Identity Telemetry

IAM Threat Detection

Detecting attacks against identity and access systems, anomalous logins, privilege escalation, suspicious entitlement changes, and credential abuse, since identity is a primary target and effective perimeter in modern environments.

Identity Hunting Value

The principle that identity data is among the highest-value sources for threat hunting, because identity is the modern attack surface, so hunting in authentication and access telemetry catches intrusions that endpoint or network hunting may miss.

IAM Detection for Meridian

A capstone exercise applying identity threat detection to a fictional organization (Meridian), designing detections for identity-based attacks as part of building that organization's identity program end to end.

Pass-the-Hash Detection

Detecting pass-the-hash attacks by spotting the abnormal authentication patterns they create, such as logons using hashes in ways or from places that legitimate authentication would not, mapped to ATT&CK techniques.

RDP Lateral Movement Detection

Detecting attackers using RDP to move between hosts, by spotting anomalous interactive logons, unusual source-to-destination patterns, and unexpected use of administrative accounts over RDP, mapped to ATT&CK.

Impossible Travel

An identity anomaly where one account signs in from two locations too far apart to travel between in the elapsed time, strongly suggesting the credentials are being used by more than one party, often an attacker.

Cloud Audit LogStart here

Network Telemetry

PAM SIEM Integration

Enrichment