What is identity threat detection and response (ITDR)?

Identity threat detection and response (ITDR) is the practice of finding and responding to attacks that target accounts, credentials and the systems that manage them, such as directories and single sign-on. When attackers log in instead of breaking in, identity logs become the main evidence.

ITDR is an industry label, not a standard. The underlying work is defined by frameworks you may already use.

Why do identities need their own detection?

Attackers prefer valid credentials, because logging in looks normal. MITRE ATT&CK names this technique Valid Accounts and lists it for several purposes: gaining initial access, staying in the environment, moving to higher privilege and avoiding detection. An intruder with a real session token or password does not trigger malware alerts.

NIST's Digital Identity Guidelines (SP 800-63) describe how to establish and authenticate identities, and discuss the strength of authenticators. They are the preventive side. ITDR is the detective side: what to do when an authenticator or session is stolen despite those controls.

What are the main attack paths?

• Credential theft and reuse, from phishing, malware or leaked password lists.
• Session theft, where an attacker steals a login token and skips the password and second factor.
• Privilege escalation, such as adding oneself to an administrator group or granting a new application broad permissions.
• Directory compromise, since the system that holds identities controls access to everything else.
• Abuse of non-human identities, such as service accounts and keys, which rarely use multi-factor authentication and are rarely reviewed.
• Persistence through identity, for example registering a new authentication device or creating a hidden account.

What signals should you watch?

• Sign-ins from impossible travel or from a new country shortly after a normal sign-in.
• A burst of failed sign-ins followed by a success.
• A new multi-factor device added, especially soon after a password reset.
• Changes to privileged groups, roles or consent grants outside change windows.
• A service account used from a new place or at a new time.
• Mass access to files or mailboxes by one identity.
• Sign-ins that skip multi-factor prompts because a token was replayed.

Treat each as a clue, not a verdict. Combine them: a new device plus a role change plus unusual file access is a strong sequence.

A constructed example

A finance employee approves a push prompt they did not start, after repeated prompts late at night. The attacker, now signed in, adds their own authenticator device, creates a mailbox rule forwarding invoices to an external address and requests access to the payments application. Each step alone might pass. Together they form a pattern: prompt fatigue, device registration, forwarding rule, new access request.

A good response is fast and identity-focused. Revoke the sessions, remove the new device, delete the rule, reset the password, review what was accessed, and tell the employee without blame.

What does a response look like?

Identity response has its own playbook. Typical actions are to revoke active sessions and tokens, force a password reset, remove unknown authentication devices, disable or restrict risky accounts, rotate keys and review audit logs for what the identity did. NIST SP 800-61 Rev. 3 frames incident response as part of risk management, so link these steps to your general plan.

How to check or apply this

1. Confirm that sign-in, directory change and privilege change logs are collected and kept for at least several months, centrally.
2. Choose five detections from the signals above and write down who investigates each.
3. Adopt phishing resistant sign-in methods for administrators first.
4. List service accounts and keys, with owners and last use. Remove what is unused.
5. Write a one page identity incident playbook and rehearse it.
6. Review privileged groups monthly for unexpected members.

Quick check

Sources

• MITRE ATT&CK, Valid Accounts (T1078)
• NIST SP 800-63, Digital Identity Guidelines
• NIST SP 800-61 Rev. 3, Incident Response Recommendations

Last reviewed: 18 October 2026.