An identity-based attack is an attack in which the adversary gains and uses legitimate identities and credentials to reach systems and data. Instead of breaking in, the attacker logs in, and every step that follows uses access the account already has.

How does an identity-based attack work?

1. Initial access: the attacker obtains a valid credential and signs in.
2. Discovery and escalation: they explore what the account can reach and look for more privileges.
3. Lateral movement: they move from system to system with legitimate tools.
4. Critical applications: they reach the systems that hold valuable data.
5. Misuse and persistence: they steal data, change configurations or create new access to stay in.

How do attackers obtain identities?

• Phishing and social engineering, including calls to the help desk.
• Credential stuffing with passwords leaked elsewhere.
• Stolen session tokens that bypass the login.
• Exposed API keys and secrets.
• Malware that harvests credentials from a device.
• Insiders who share or sell access.

Which techniques are common?

Pass-the-hash, Kerberoasting and golden tickets against Active Directory, token theft and MFA fatigue against cloud accounts, privilege escalation through misconfigured groups and lateral movement with legitimate administration tools. Each of them abuses how identity systems are designed to work.

What does an identity-based attack look like in practice?

An employee is phished and the attacker signs in with their credentials from a new location. They query the directory, request service tickets for service accounts, use a legitimate remote administration tool to reach a file server and then a database. Each step uses valid access, and nothing triggers a malware alert.

What is the difference between an identity-based attack and a credential attack?

A credential attack, such as credential stuffing, is one way to obtain an identity. An identity-based attack covers the whole chain: getting the identity, escalating, moving and misusing it.

Can MFA stop identity-based attacks?

It helps at the first step, because a stolen password alone is no longer enough. It does not stop stolen session tokens, MFA fatigue or abuse of an account after it has signed in, so MFA needs to be backed by monitoring of behaviour.

Why are identity-based attacks hard to detect?

There is no exploit and no malware. The attacker holds a valid account, and each action is something that account is allowed to do. Traditional tools look for malicious files, known signatures and network anomalies, and none of those appears.

Why are traditional tools not enough?

They see events, such as a login or a process, but not whether the behaviour behind them is normal for that identity. A successful MFA prompt tells you the login was approved, not that the person behind it is who they claim to be. The signal is in behaviour: the wrong system, the wrong hour, the wrong volume or the wrong query for that identity.

What are the warning signs?

• Logins to systems an account never uses.
• Privilege or group changes outside normal change windows.
• Bulk queries or exports that are new for that identity.
• Dormant accounts that suddenly become active.
• Use of remote administration tools by non-administrators.

Which identities do attackers target?

Privileged accounts, service accounts, API keys, cloud administrators and third-party access. These combine broad rights with weak oversight, so they give the attacker the most for the least effort.

How do you defend against identity-based attacks?

Reduce the paths first: apply least privilege, close MFA gaps, retire dormant accounts and scope non-human identities narrowly. Then watch behaviour across all stages, including what happens inside critical applications, and respond quickly, because every hour of delay gives the attacker more room to move.

Sharelock covers the chain with prevention, which maps identities and privileges, detection, which monitors behaviour after login down to individual transactions and queries, and response, which investigates and acts autonomously within guardrails.