Newsletter Article
Attackers Follow Trust, Not Infrastructure
Snare Insider Newsletter Series Article
Make sure you Subscribe
For years, security teams have built investigations around a familiar sequence. An attacker compromises a device. Activity appears on an endpoint. Credentials are obtained, privileges increase and the attacker moves laterally, with security telemetry following each step.
That sequence still exists. But increasingly, attackers don’t need to follow it.
In July we wrote that attackers don’t break in, they log in. Since then the question has moved on. It is no longer only whether a login was legitimate. It is where everything that happened after the login was recorded.
A valid credential, an authenticated session, an OAuth permission, a service account or a compromised third-party relationship can give an attacker direct access to the applications and infrastructure they want. No malware may be needed, there may be no obvious lateral movement, and some of the most important evidence may never exist on an endpoint at all.
The MITRE ATT&CK techniques involved build on the Valid Accounts technique (T1078) we covered in July: Cloud Accounts (T1078.004), Steal Application Access Token (T1528), Application Access Token (T1550.001), Additional Cloud Roles (T1098.003) and Trusted Relationship (T1199). Each one abuses something the organisation deliberately trusts.
Identity has become part of the attack infrastructure
Gartner named identity-first security a top security and risk management trend in 2021. It described an approach that puts identity at the centre of security design and moves away from traditional LAN-edge thinking.[1] Five years on, Microsoft’s Digital Defense Report 2026 calls identity “the primary control plane for defense”, one that now spans human and non-human identities, including applications and agents.[2]
Government assessment data points the same way. CISA analysed 143 Risk and Vulnerability Assessments across federal and critical infrastructure networks and found Valid Accounts was the most common successful initial access technique, at 41% of successful attempts. Assessors then reused those accounts for lateral movement, privilege escalation and defence evasion.[3]
Microsoft’s incident data shows what that looks like in real intrusions: in 52.2% of valid-account intrusions, attackers went on to steal additional credentials.[2] One compromised identity becomes several, and the investigation has to follow every one of them.
The route in keeps changing. ENISA’s Threat Landscape 2026, covering calendar year 2025, records device code phishing by multiple intrusion sets. It also records vishing campaigns impersonating IT staff that gave operators access to connected SaaS platforms including Salesforce, Microsoft 365, SharePoint and Slack.[4] September’s Threat Spotlight, The Tools You Trust Are Becoming Attack Paths, tracked how quickly those techniques are accelerating.
The same chain, more places
Week 2’s Evidence Gap Drill asked you to rebuild one investigation chain:
identity → device → access → privilege → action → destination → outcome |
In an identity-led attack, the chain stays the same but its links spread out. No link is guaranteed to sit in one evidence plane, and several now sit in places the endpoint never sees.
| Link | Where the evidence can now sit | Example records |
| Identity | Identity provider; on-premises directory; service principal and agent registrations | Entra ID user or service principal object ID; Active Directory SID; the onPremisesSecurityIdentifier attribute that joins the two |
| Device | Identity provider device registration; endpoint | Entra ID audit “Register device”; sign-in device details; workstation name in Windows 4624 |
| Access | Identity provider sign-in; OAuth consent; SaaS login; host logon | Entra ID sign-in with authenticationProtocol = deviceCode; “Consent to application”; Windows 4624 (logon type 3 or 10) |
| Privilege | Directory roles; cloud IAM; local groups | “Add member to role”; Azure roleAssignments/write; AWS AttachRolePolicy; Windows 4672, 4728, 4732 |
| Action | SaaS audit; cloud control plane; host | New-InboxRule; CreateAccessKey; SetIamPolicy; Windows 4688, 7045 |
| Destination | SaaS data; cloud data plane; servers | MailItemsAccessed; FileDownloaded; S3 GetObject (data events); Windows 4769 |
| Outcome | Wherever the result is recorded | Bulk export events; GetSecretValue; storage reads; egress logs |
An analyst working from endpoint telemetry alone would see, at most, a few of these rows. In a SaaS-only intrusion they might see none.
Identity is now a way to control infrastructure
ENISA identifies the targeting of cloud environments, third-party providers and other cyber dependencies among the defining threat trends of 2025.[4] The NSA and CISA’s Top Ten Cloud Security Mitigation Strategies put secure cloud identity and access management second on the list and managing cloud logs for threat hunting tenth.[5]
Microsoft’s data shows what that priority guards against in critical infrastructure: cloud identity abuse was the most observed technique against critical infrastructure, appearing in 78% of observed activity.[2] It echoes CISA’s assessment finding above: legitimate identities are the most reliable way into critical infrastructure networks.
This isn’t an argument that endpoints are becoming irrelevant. Endpoint and server telemetry remains fundamental. The point is that infrastructure can now be changed through an identity, and the record of that change lives in the identity and cloud control planes as well as on the host.
The investigation perimeter has expanded
Logging architecture needs to expand with it. The governing frameworks already point that way. NIST CSF 2.0 subcategory DE.AE-03 requires that information is correlated from multiple sources.[7] The joint guidance from ASD’s ACSC, CISA, NSA, FBI and international partners, Best Practices for Event Logging and Threat Detection, lists centralised log collection and correlation among its key factors. Its purpose is to surface living-off-the-land activity that looks legitimate in any single log.[8]
Key takeaway
If an attacker can operate there, you need to decide what evidence you need from there.
Don’t let the first incident involving a SaaS application, cloud identity or non-human account be the first time you ask whether its logs exist, how long they are kept and who can retrieve them.
References
- Gartner, “Gartner Identifies Top Security and Risk Management Trends for 2021”, 23 March 2021. https://www.gartner.com/en/newsroom/press-releases/2021-03-23-gartner-identifies-top-security-and-risk-management-t
- Microsoft, Digital Defense Report 2026 (published 1 October 2026; data period July 2025 to June 2026). https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/
- CISA, Risk and Vulnerability Assessment (RVA) Analysis FY23, September 2024. https://cisa.gov/sites/default/files/2024-09/FY23_RVA_Analysis_508.pdf
- ENISA, ENISA Threat Landscape 2026 (September 2026; reporting period January to December 2025). https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202026_Final.pdf
- NSA and CISA, Top Ten Cloud Security Mitigation Strategies, 7 March 2024. https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3699169/nsa-releases-top-ten-cloud-security-mitigation-strategies/
- Gartner, Top Strategic Predictions for 2025 and Beyond, presented at Gartner IT Symposium/Xpo, October 2024 (as reported by PCMag, 25 October 2024). https://tech.yahoo.com/ai/articles/riding-ai-whirlwind-gartners-top-145804243.html
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 2024, DE.AE-03. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- ASD’s ACSC with CISA, FBI, NSA and international partners, Best Practices for Event Logging and Threat Detection, August 2024. https://www.cyber.gov.au/business-government/detecting-responding-to-threats/event-logging/best-practices-for-event-logging-and-threat-detection
- MITRE ATT&CK Enterprise Matrix: T1078, T1078.004, T1528, T1550.001, T1098.003, T1199. https://attack.mitre.org/
