Identity threat detection and response

A non-transitory computer-readable medium for storing computer logic having instruction that enable a processor to:

• conducting a proactive identity-centric scan of a directory of a network domain by executing Lightweight Directory Access Protocol (LDAP) queries from an endpoint device joined to the domain to enumerate directory schema objects, user accounts, computers, organizational units, and configuration parameters and to identify misconfigurations excessive privileges, or risky entitlements;
• computing, from results of the scan, an identity risk posture representing an identity attack-surface visibility for the directory;
• guiding an administrator via a user interface by presenting remediation guidance for the identified vulnerabilities, the guidance including one or more of a risk score, a prioritized remediation list, an explanation of potential exploitation paths, or a MITRE ATT&CK mapping, to enable configuration of the directory to reduce the potential security risk;
• and
• monitoring the directory in real time for identity-based attacks leveraging the identified vulnerabilities, including high-fidelity detection of at least one of a DCSync attack, a DCShadow attack, Kerberoasting, or LDAP enumeration, and automatically signaling a Zero Trust Network Access (ZTNA) system to contain the attack by blocking a compromised user or endpoint from accessing protected resources.

An Identity Threat Detection and Response (ITDR) method comprising the steps of:

• conducting a proactive identity-centric scan of a directory of a network domain by executing Lightweight Directory Access Protocol (LDAP) queries from an endpoint device joined to the domain to enumerate directory schema objects, user accounts, computers, organizational units, and configuration parameters and to identify misconfigurations excessive privileges, or risky entitlements;
• computing, from results of the scan, an identity risk posture representing an identity attack-surface visibility for the directory;
• guiding an administrator via a user interface by presenting remediation guidance for the identified vulnerabilities, the guidance including one or more of a risk score, a prioritized remediation list, an explanation of potential exploitation paths, or a MITRE ATT&CK mapping, to enable configuration of the directory to reduce the potential security risk;
• and
• monitoring the directory in real time for identity-based attacks leveraging the identified vulnerabilities, including high-fidelity detection of at least one of a DCSync attack, a DCShadow attack, Kerberoasting, or LDAP enumeration, and automatically signaling a Zero Trust Network Access (ZTNA) system to contain the attack by blocking a compromised user or end om accessing protected resources.