ITDR and cyber deception: detecting credential misuse

An attacker with a cached Kerberos ticket or a foothold on a synchronization agent does not need to break in. Identity Threat Detection and Response (ITDR) systems depend on signature-based detection, anomaly analysis, and log signal to flag that kind of activity, and several current credential-misuse techniques produce none of the three. That is a gap in the available evidence, not a failing tool: the activity can look identical to a legitimate sign-in until something forces the question of intent. As attackers increasingly exploit third-party components and stolen credentials, the evidence signature, anomaly, and log analysis have to work with strains further.

• ITDR watches Active Directory (AD) and cloud identity stores for signature, anomaly, and log-based evidence of credential misuse.
• Four techniques evade that evidence chain: cached credential extraction, third-party sync agent abuse, offline or client-side attacks, and adversary-in-the-middle theft.
• Deception adds honey accounts and honeytokens, so any interaction becomes a high-confidence signal, layered alongside ITDR rather than in place of it.
• Leader and Outperformer in the GigaOm Radar for Deception Technology, four consecutive years, most recently 2026. Source: acalvio.com/resources/analyst-reports.

Despite the deployment of traditional monitoring approaches on Active Directory (AD) and cloud identity stores, identity-based attacks are continuing to escalate at an alarming rate. Attackers have evolved techniques for credential misuse and privilege escalation that produce little signature, anomaly, or log signal for ITDR to work with, including:

Cached credentials

Cached credentials are copies of user authentication data, including passwords, session tokens, and Kerberos tickets, that systems store locally to speed up re-authentication. While they improve performance and user convenience, they also give attackers a potential goldmine. Cybercriminals use tools such as Mimikatz, LaZagne, Seatbelt, and other credential dumping utilities to extract these credentials from caches including the Windows Security Accounts Manager (SAM), the Local Security Authority Subsystem Service (LSASS) cache, and browser caches, letting them persist within networks, move laterally across systems, and escalate privileges. The subtlety of these attacks means the signal available to traditional security measures strains to differentiate legitimate use of these credentials from malicious use.

Third-party sync agents and identity stores beyond AD

Synchronization agents and servers such as Active Directory Federation Services (ADFS) and Active Directory Certificate Services (ADCS) carry trusted access to Active Directory, and attackers target them to reach domain credentials, using the limited monitoring on these components to obtain privileged credentials. Organizations increasingly adopt a hybrid identity architecture with cloud identity providers (IdP) for identity federation, and deploy synchronization agents to keep AD in sync with the cloud IdP.

Stealthy attacks that evade traditional detection mechanisms

Offline attacks such as Kerberoasting and client-side attacks such as Silver Ticket forgery are being used with increasing frequency by attackers, and neither results in anomalous network traffic or an event log trace, so detection approaches based on monitoring AD network traffic and logs have little to work with. Attackers have evolved stealthy attacks that evade traditional detection mechanisms in this way, leaving signature and log-based monitoring without the evidence it depends on.

Adversary in the middle (AITM) attacks

Attackers gain access to domain credentials through AITM techniques such as LLMNR poisoning and use these credentials for lateral movement. Because the credentials themselves are valid, signature and log-based monitoring strains to distinguish that later use from a legitimate sign-in.

Cyber deception emerges as a critical solution to these challenges. It introduces deceptive elements, such as honey accounts and honeytokens, strategically placed within the identity stores and endpoints to lure and detect attackers by triggering high-confidence indicators of an incursion. This proactive defense mechanism not only enhances detection capabilities but also provides actionable intelligence, enabling more effective and rapid response. Layered alongside signature, anomaly, and log-based analysis, especially in the context of cached credentials and stealthy identity attack techniques, cyber deception creates a more resilient and adaptive security posture against the increasingly complex threat landscape.

Anomaly-based detection flags identity activity that deviates from a baseline, and normal work routinely produces that kind of deviation: a new device, a role change, or a first login from a new location can all look unusual even when nothing is wrong. Each deviation becomes an alert a SOC analyst has to triage by inferring intent from indirect evidence, and most of that queue resolves to nothing. A decoy asks a different, binary question: did anything touch an asset no legitimate process should need. There is no ambiguous middle ground, because a honey account or honeytoken has no legitimate use, so an interaction either happened or it did not. That distinction matters where SOC triage time is scarce, since a growing alert backlog gives lesser-skilled attackers more room to operate before anyone reaches the alert that matters.

Modern ransomware and APT threats are continuing to escalate in frequency and impact despite traditional ITDR tooling being in place. Attackers are exploiting the gaps in traditional ITDR to breach the defenses. Identity-based attacks have continued to grow at an alarming pace, highlighting the need for strengthening cyber defense.

As attacks have increasingly adopted identity compromise, cybersecurity has needed to evolve beyond endpoint and network-centric defenses to an identity-centric defense approach. ITDR, with its focus on identity threats, is a framework and strategy to defend against modern cyber threats. To realize the value of ITDR, a defense-in-depth approach that combines detection approaches (anomaly and log-based detection combined with cyber deception) is essential.

• Early threat detection: Attackers gain initial access to an endpoint and attempt to exploit the identity architecture. Honeytokens deployed across the endpoints enable defense teams to detect the attack on the initial beachhead, enabling response actions to isolate the threat and protect the identity architecture.
• Comprehensive Identity Protection: Cyber deception eliminates the gaps associated with traditional ITDR, detecting attacks that exploit these gaps. Deception-based detection is agnostic to attacker TTPs, enabling continuing coverage as attackers evolve novel attack vectors.
• Precise Detection Engineering and Response: ITDR can provide actionable alerts by incorporating deception. Traditional detection might label many activities as “suspicious,” complicating the task of distinguishing between harmful and benign actions. Deception ensures that interactions with honeytokens are definitive indicators of malicious activity, thus streamlining the detection and response processes.
• Mislead and Slow Down the Attacker: The deployment of honeytoken accounts that are made vulnerable intentionally to attract attackers not only detects when an attack occurs but also misleads the attacker, wasting their resources and giving IT teams more time to respond.