Topic starter
12/07/2026 12:20 pm
TL;DR: Identity-based attacks remain effective because intruders can steal administrative credentials, use pass-the-hash over NTLM, and move laterally with minimal engagement, according to SentinelOne’s analysis of Sandman APT. Early detection and identity-focused deception change the defender’s odds, but only if credential discovery and lateral movement are treated as identity problems, not endpoint anomalies.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “Exit Sandman | How SentinelOne Deflects APT-Level Identity Security Risks”.
Key questions
Q: What breaks when attackers can reuse stolen identity material on a network?
A: When stolen identity material can be replayed, the attacker no longer needs a fresh exploit for every step.
Q: Why do pass-the-hash attacks still matter in modern identity security programmes?
A: They matter because replayable authentication artefacts let attackers turn one compromised credential into broad internal access without knowing the underlying password.
Q: How do teams know whether identity-based detection is working?
A: Look for detections that correlate identity, behaviour, and privilege changes across environments, not just isolated alerts.
Practitioner guidance
- Harden administrative credential paths Reduce where privileged credentials can be discovered, cached, or replayed on endpoints and in directory services.
- Detect pass-the-hash behaviour Correlate NTLM-based authentication with unusual source hosts, unusual target systems, and repeated access to the same workstation cluster.
- Instrument identity deception Deploy decoy credentials and decoy directory objects where attackers normally search for privileged identity data, so reconnaissance and lateral movement generate high-confidence alerts.
Bottom line: Identity-based intrusion chains work because stolen credentials can make malicious activity look like legitimate access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:34 pm
Identity-based intrusion chains expose a detection gap, not just a credential problem. The article shows that once attackers can authenticate as a legitimate user, the incident no longer looks like a classic perimeter breach. Identity activity becomes the carrier for reconnaissance, lateral movement, and eventual information theft. That means early detection must follow the identity trail, not wait for endpoint compromise to become obvious.
A question worth separating out:
Q: What should teams do when identity deception reveals an active intruder?
A: Contain the affected identity path first, then isolate the endpoint and any adjacent systems that share the same trust context. The goal is to stop credential reuse and prevent the attacker from turning one foothold into multiple authenticated sessions. Use the deception event as evidence that the attacker is already inside the identity plane.
👉 Read our full editorial: Identity-based intrusion chains expose gaps in early detection