Identity Attack Paths: How Hackers Move Through Enterprise Accounts

📅 September 24, 2026  |  🏷 General  |  Cyber Security, Information Security, Threat Management

A single compromised help desk credential handed attackers the keys to MGM Resorts International’s entire identity infrastructure in 2023 — a ten-minute social engineering call that cascaded into $100 million in operational losses. The attacker didn’t break through a firewall. They walked through the front door using a legitimate account. This is the defining characteristic of modern enterprise intrusions: the weapon is identity itself.

Identity attack paths — the chains of account compromises, privilege escalations, and lateral movements that hackers string together to reach high-value targets — have become the primary methodology for sophisticated threat actors. According to CrowdStrike’s 2026 Global Threat Report, 79% of cyberattacks to gain initial access are now malware-free, relying instead on stolen credentials, legitimate remote management tools, and identity-based exploitation. Understanding exactly how these paths are constructed, and where defenders can interrupt them, is no longer optional for enterprise security teams.

The Anatomy of an Identity Attack Chain

Identity attacks rarely involve a single dramatic breach. They unfold as a deliberate sequence — each compromised account becoming the stepping stone to the next. Security researchers at Microsoft call this pattern “the identity kill chain,” and it follows a remarkably consistent structure regardless of the threat actor group executing it.

The chain typically begins with initial access: a phishing email, a credential-stuffing attack against an exposed VPN portal, or a purchased credential set from a dark web broker. From there, the attacker conducts reconnaissance within the identity plane — querying Active Directory, enumerating group memberships, and identifying service accounts. Next comes lateral movement through pass-the-hash, Kerberoasting, or token manipulation. Finally, the attacker reaches privilege escalation, obtaining domain administrator rights or cloud tenant ownership that enables their ultimate objective.

Reconnaissance Inside the Identity Plane

What makes identity attacks uniquely dangerous is that reconnaissance happens inside the perimeter using entirely legitimate tools. An attacker with a standard domain user account can run BloodHound — an open-source Active Directory enumeration tool — and within minutes generate a complete graph of every privilege escalation path in the environment. BloodHound doesn’t exploit a vulnerability; it simply reads data that Active Directory makes available to all authenticated users by design.

In a 2025 red team engagement published by Mandiant, assessors documented that from a single low-privilege user account, their team identified a viable path to Domain Admin in 100% of tested enterprise environments — with an average chain length of just 3.4 hops. The organizations weren’t poorly defended by conventional standards; most had mature endpoint detection and active firewalls. The identity plane simply wasn’t monitored with equivalent rigor.

Service Accounts: The Forgotten Attack Surface

Service accounts represent one of the most consistently exploited categories in identity attack chains. These accounts — created to run automated processes, database connections, and scheduled tasks — are frequently over-privileged, rarely rotated, and almost never monitored for anomalous logon behavior. They also tend to have passwords set years ago, often never subject to an expiration policy, making them prime Kerberoasting targets.

Kerberoasting allows any domain-authenticated user to request a Kerberos service ticket for a service account and then attempt to crack the ticket’s encryption offline, entirely outside the target environment’s detection perimeter. A service account with a weak or reused password can be compromised within hours — sometimes minutes — on modern GPU cracking hardware.

Cloud Identity: Where the New Battleground Lives

The migration to cloud infrastructure hasn’t simplified the identity attack surface — it has multiplied it. Enterprise environments now span on-premises Active Directory, Azure AD (now Entra ID), AWS IAM, Okta, and a constellation of SaaS applications, each with its own permission model. Attackers who understand these interconnections can pivot between cloud tenants in ways that completely bypass traditional network-based detection.

The 2025 Scattered Spider campaigns demonstrated this with exceptional clarity. After compromising an Okta tenant administrator account, the threat actors were able to impersonate any user across every application federated to that tenant — effectively owning hundreds of business applications from a single identity provider breach. Okta subsequently reported that super administrator accounts were the target in over 60% of their incident investigations that year.

Entra ID Privilege Escalation Paths

Microsoft’s Entra ID (formerly Azure Active Directory) contains several role assignments that create non-obvious escalation paths. The Application Administrator role, for instance, can modify the credentials of any application service principal — including those assigned high-privilege roles. An attacker who compromises an Application Administrator account can therefore indirectly gain Global Administrator access without ever touching the Global Admin account itself.

Similarly, the “Privileged Authentication Administrator” role allows resetting authentication methods for Global Admins, creating a direct escalation path that many organizations leave unmonitored. Security teams focused on protecting explicit administrator accounts often miss these indirect vectors entirely. Microsoft’s own security documentation now refers to these as “Tier Zero” assets — the set of identities and resources from which Global Admin can be reached in one or two steps.

Cross-Tenant and Multi-Cloud Movement

Federated identity creates cross-organizational attack paths that are particularly difficult to detect and contain. When an attacker compromises an identity provider token, they can potentially traverse trust relationships between partner organizations, subsidiaries, and managed service providers. The SolarWinds attack exploited precisely this dynamic: by compromising the SolarWinds build pipeline, attackers seeded access that traversed thousands of customer tenants through trusted software update mechanisms.

In multi-cloud environments, AWS IAM roles assumed through web identity federation and Azure workload identities create machine-to-machine trust relationships. A compromised Kubernetes service account with cross-cloud role assumptions can enable lateral movement from an on-premises workload to a cloud data store without a single credential being explicitly stolen.

Common Lateral Movement Techniques in Enterprise Networks

Once initial access is established, attackers deploy a toolkit of identity manipulation techniques refined over decades of offensive research. Understanding these techniques in technical detail is essential for building detection logic that actually catches them.

Pass-the-Hash (PtH) allows an attacker to authenticate using an NTLM hash extracted from memory — typically via tools like Mimikatz — without knowing the plaintext password. Since Windows uses the same hash for authentication across sessions, any system where the same administrative account is used becomes compromised the moment the hash is extracted from any one of them.

Pass-the-Ticket (PtT) is the Kerberos equivalent: extracted Kerberos tickets (TGTs or service tickets) can be injected into a new session, impersonating the original user without credential knowledge. The “Golden Ticket” attack — forging TGTs using the extracted KRBTGT account hash — grants persistent, nearly undetectable access to every resource in the domain for the ticket’s validity period, which defaults to 10 years in Active Directory.

Token Manipulation in Cloud Environments

In cloud and web-based identity architectures, the equivalent of pass-the-hash is OAuth token theft and manipulation. Attackers who can intercept or steal OAuth access tokens — through phishing pages, malicious applications, or compromised browser sessions — can impersonate users across any application that trusts those tokens. The “Illicit Consent Grant” attack vector, in which users are tricked into granting permissions to malicious OAuth applications, has become a staple of business email compromise campaigns.

Microsoft’s DART (Detection and Response Team) documented a 2025 campaign in which threat actors used a single illicit consent grant to an apparently legitimate productivity application to harvest mail.read permissions across a 12,000-seat enterprise. Over three weeks, the attackers exfiltrated financial projections and M&A documentation without triggering any traditional security alerts, because the access was technically authorized.

LSASS Memory Attacks and Credential Dumping

The Local Security Authority Subsystem Service (LSASS) process in Windows caches credentials in memory by design, enabling single sign-on functionality. Tools like Mimikatz, ProcDump, and comsvcs.dll dumping can extract plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory — the foundational step in most Windows-based lateral movement chains. Microsoft’s Credential Guard, available in Windows 11 and Server 2022, isolates credential material in a Hyper-V protected container, but deployment remains inconsistent across enterprise fleets as of 2026.

Detection Strategies: Seeing the Attack Path Before It Completes

The challenge with identity attack detection is behavioral: most of the techniques described above use legitimate protocols and generate authentication events that look structurally identical to normal user activity. Detection depends on baselining normal behavior and identifying statistical anomalies — impossible without robust identity telemetry.

Gartner’s 2026 Market Guide for Identity Threat Detection and Response (ITDR) identifies this category as the fastest-growing segment in enterprise security tooling, with adoption increasing by 340% between 2023 and 2026. ITDR platforms — purpose-built to ingest identity plane telemetry from AD, Entra ID, Okta, and cloud IAM — apply behavioral analytics to detect lateral movement patterns that SIEM tools historically missed.

Attack Path Management and Graph-Based Detection

Attack path management tools — including Microsoft’s Defender for Identity, SpecterOps’ BloodHound Enterprise, and Tenable.ad — continuously model the identity graph to identify which accounts, if compromised, would provide a path to critical assets. Rather than waiting to detect an attack in progress, these tools allow organizations to surgically eliminate escalation paths before they can be exploited.

The operational recommendation is straightforward but demanding: treat any identity from which Domain Admin or Global Admin can be reached in three or fewer hops as a Tier Zero asset, subject to the same access controls, monitoring rigor, and authentication requirements as explicit administrator accounts. In most enterprise environments, this expands the protected set significantly — and reveals the true scope of the identity attack surface for the first time.

Behavioral Baselines and Impossible Travel Alerts

Conditional access policies that flag logons from unexpected geographies, unusual authentication times, or atypical device postures provide a second detection layer. “Impossible travel” alerts — where the same account authenticates from New York and Singapore within two hours — have become table-stakes for cloud identity monitoring, but must be paired with authentication context enrichment to avoid alert fatigue from legitimate VPN or travel scenarios.

More sophisticated behavioral models track authentication graph patterns: a standard user account that suddenly begins querying domain controller LDAP for group membership data, or requesting service tickets for a dozen service accounts in rapid succession, exhibits the hallmark signature of BloodHound enumeration or Kerberoasting even if every individual action is technically authorized.

Privileged Access Architecture: Building Resistance Into the Identity Plane

Detection alone cannot contain sophisticated identity attacks — architecture must make the attack paths harder to complete in the first place. Microsoft’s Enterprise Access Model (formerly the tiered administration model) provides a practical framework: segregating administrative identities into tiers based on the blast radius of their compromise, and enforcing strict isolation between tiers.

The core principle is that Tier Zero administrative accounts — those controlling the identity infrastructure itself — must never be exposed to surfaces that lower-tier accounts can influence. A Domain Admin should never log into a workstation that a standard user can also access; doing so deposits credential material on a system accessible to a much larger attack surface. Privileged Access Workstations (PAWs), dedicated devices used exclusively for administrative tasks and locked down to prevent web browsing and email access, remain the gold standard for protecting privileged identity operations.

Just-in-Time and Just-Enough-Access Frameworks

Persistent privileged access — accounts that hold administrative rights continuously rather than on demand — represents an unnecessary expansion of attack surface. Just-in-Time (JIT) access frameworks, implemented through tools like Microsoft Privileged Identity Management (PIM), CyberArk, or BeyondTrust, grant elevated privileges for specific time windows in response to approved requests, then automatically revoke them. An attacker who compromises an account between administrative sessions gains no privileged access at all.

The operational discipline required to maintain JIT access is substantial, but the security dividend is proportionally significant. Organizations that have implemented comprehensive JIT access have reported reducing their Tier Zero credential exposure window by over 90%, fundamentally altering the economics of identity-based attacks against them.

Key Takeaways

• Identity attack paths are constructed, not discovered: Attackers systematically enumerate the identity graph using legitimate tools, mapping escalation routes before executing any lateral movement. Eliminating these paths proactively — not just detecting traversal — is the highest-leverage defensive investment.
• Service accounts and indirect role assignments are consistently under-protected: Kerberoastable service accounts and cloud roles like Application Administrator represent frequently overlooked escalation vectors. Inventory, password hygiene, and monitoring for these account types must match the rigor applied to explicit privileged accounts.
• Cloud identity federation creates cross-boundary attack paths: Federated identity providers and cross-cloud IAM role assumptions extend attack paths beyond traditional network boundaries. Tenant-level super-administrator accounts require MFA, PAW access, and continuous behavioral monitoring as an absolute minimum.
• ITDR is now essential, not optional: Traditional SIEM and EDR tools lack the identity-plane telemetry and graph-based analytics needed to detect lateral movement through AD and cloud IAM. Dedicated Identity Threat Detection and Response tooling addresses this gap specifically.
• Just-in-Time access architectures fundamentally change attacker economics: Eliminating persistent privileged access forces attackers to operate within defined windows and generates high-fidelity alerts. JIT implementation should be prioritized for all Tier Zero and Tier One identities regardless of organization size.

Conclusion: Reframe Identity as Infrastructure

The consistent thread across every enterprise breach fueled by identity attack paths is the same: organizations treated identity as an authentication convenience rather than as critical infrastructure requiring security engineering. The AD environment was never modeled as an attack graph. Cloud IAM roles were assigned permissively and never reviewed. Service accounts accumulated privileges over years without anyone auditing who — or what — could request their tickets.

Reversing that posture requires a concrete program, not a philosophy. Start this week by running BloodHound or Defender for Identity’s attack path analysis against your production Active Directory environment. Identify every account from which Domain Admin can be reached in four hops or fewer. You will likely find the list is ten times longer than expected. Use that list as the priority backlog for your identity hardening program: reset service account passwords, remove unnecessary group memberships, enforce PAW access for Tier Zero identities, and implement PIM for privileged cloud roles.

The attackers already know your identity graph. The only question is whether your security team does too.