August 18, 2026
Attackers Don’t Need Malware Anymore: The Rise of Identity-Based Attacks
For years, one of the most familiar images of a cyberattack was a malicious file landing on an endpoint.
A suspicious executable appears. An antivirus alert fires. An analyst investigates the process tree, isolates the machine, and begins looking for signs of compromise.
However, attackers do not always need to place a malicious file on a system. In many cases, they can simply log in.
As a result, identity-based attacks are becoming a major challenge for security teams. Attackers are abusing stolen credentials, password spraying, compromised accounts, session tokens, and other legitimate authentication mechanisms to gain access while appearing, at least initially, like normal users.
Microsoft reported that identity-based attacks increased by 32% during the first half of 2025, with more than 97% of those attacks involving password attacks.
At the same time, recent industry research continues to identify credential abuse as a significant breach vector, while highlighting how attackers are increasingly combining traditional techniques with automation and AI.
For the Blue Team, this creates a fundamental problem:
A successful login does not necessarily mean a legitimate user.
The Identity Has Become the Attack Surface
Modern organizations depend heavily on digital identities. Employees use their accounts to access email, VPNs, cloud platforms, SaaS applications, internal systems, development environments, administrative consoles, and security tools.
Therefore, one compromised account can give an attacker access to several systems without requiring malware.
As a result, defenders must change how they investigate suspicious activity.
Traditional endpoint detection asks:
“Is malicious software running on this computer?”
Identity-based detection asks:
“Does this login match the user’s normal behavior?”
The second question is harder to answer. An employee may log in from a new location. Meanwhile, an administrator might access a server outside normal working hours. Service accounts can also authenticate hundreds of times as part of their normal activity. In addition, a user may connect from an IP address that the organization has never seen before.
None of these events is automatically malicious. Instead, the security team must examine the context around each event.
How Attackers Abuse Legitimate Accounts
Identity-based attacks can take several forms.
Password Spraying
Instead of trying thousands of passwords against one account, an attacker may try a small number of commonly used passwords against many accounts.
This approach is designed to avoid triggering account lockout policies while identifying users with weak or reused credentials.
From a SOC perspective, password spraying can create a clear pattern:
Multiple accounts
↓
Same source IP
↓
Repeated login failures
↓
Few attempts per account
↓
One successful login
Credential Stuffing
Credential stuffing takes advantage of password reuse. Attackers obtain username and password combinations from earlier breaches and try them on other services.
In this case, the attacker does not need to exploit a software weakness. Instead, the attacker takes advantage of a common human behavior: password reuse.
The research continues to highlight the importance of stolen credentials, especially when attackers use them to gain initial access.
Valid Account Abuse
This is where the distinction between authentication and compromise becomes particularly important.
An attacker who obtains valid credentials may be able to authenticate successfully.
From the authentication system’s perspective:
Username: valid
Password: valid
Authentication: successful
But from the organization’s perspective:
User behavior: abnormal
This is why modern detection cannot stop at:
“Did the login succeed?”
It needs to ask:
“Does this login make sense?”
When a Normal Login Becomes Suspicious
Consider a simple example.
A user normally works from Greece during business hours.
One morning, the same account authenticates successfully from an unfamiliar geographic location.
Shortly afterwards:
- The account accesses a privileged application.
- A large number of files are accessed.
- A new authentication session appears.
- The account begins communicating with systems it has never accessed before.
None of these events necessarily proves compromise.
Together, however, they create a much stronger signal.
This is where correlation becomes more valuable than individual alerts.
A modern SOC should be able to connect:
Authentication → Identity → Endpoint → Network → Application → User behavior
instead of investigating every event in isolation.
MFA Helps, But It Is Not the End of the Story
Multi-factor authentication significantly improves security, particularly phishing-resistant MFA.
Microsoft reports that phishing-resistant MFA can prevent more than 99% of identity-based attacks.
But MFA should not be treated as a reason to stop monitoring identity.
Attackers have increasingly targeted authentication sessions and authentication workflows themselves.
Examples include:
- MFA fatigue attacks
- Adversary-in-the-Middle (AiTM) techniques
- session/token theft
- malicious OAuth consent
- compromised recovery mechanisms
- stolen browser sessions
This means the security question is evolving from:
“Did the user authenticate with MFA?”
to:
“Was the entire authentication session legitimate?”
That distinction matters.
An attacker who obtains a valid authenticated session may not need to defeat MFA again.
What Should a Blue Team Monitor?
Identity security starts with visibility.
A SOC should ideally have access to authentication and identity-related telemetry such as:
- Successful and failed logins
- Source IP addresses
- Geographic information
- Authentication methods
- MFA events
- Account lockouts
- Password changes
- Privilege changes
- New account creation
- Group membership changes
- VPN authentication
- Cloud authentication
- OAuth/application consent
- Session activity
- Administrative actions
But collecting the logs is only the first step.
The real value comes from turning those events into detections and investigation context.
From Authentication Event to Detection
Imagine the SIEM receives the following events:
10:01 — 15 failed logins against multiple users
10:03 — Successful login for one of those accounts
10:05 — Login originates from an unusual IP
10:07 — User accesses a privileged system
10:10 — Large number of files accessed
A basic SIEM might generate five separate alerts.
A stronger detection strategy can connect those events into a single investigation.
The SOC analyst can now see a possible attack chain:
Password Spray → Valid Account → Anomalous Login → Privileged Access → Data Access
This is much more useful than five disconnected notifications.
How Logstail Fits Into the Picture
This is where the role of a modern SIEM becomes particularly important.
At Logstail, security monitoring is designed around turning large volumes of security telemetry into actionable visibility. Logstail’s Security Suite combines SIEM monitoring, detection rules, alerting, dashboards, case management, and automated response capabilities.
For identity-based attacks, this means authentication data does not have to exist as isolated events.
It can become part of a broader detection workflow.
For example, an organization could monitor for patterns such as:
Multiple failed authentications
↓
Successful authentication
↓
Unusual source or location
↓
Sensitive resource access
↓
Suspicious endpoint/network activity
↓
SOC investigation
The goal is not simply to generate another alert.
The goal is to provide the analyst with enough context to answer:
“Is this a user having an unusual day, or an attacker using a legitimate identity?”
Detection Engineering Matters
Identity monitoring also highlights an important principle of SOC operations:
More alerts do not necessarily mean better security.
A rule that generates an alert every time a user logs in from a new IP address could quickly become unusable.
Instead, detection engineering should consider multiple signals.
For example:
Low confidence
New IP address
↓
Medium confidence
New IP + unusual location
↓
Higher confidence
New IP + unusual location + privileged access
↓
High confidence
New IP + unusual location + privileged access + suspicious endpoint activity
This approach allows the SOC to prioritize events based on context and risk.
It also reduces the noise that can lead to alert fatigue.
Identity Detection Should Not Live in Isolation
One of the biggest mistakes organizations can make is treating identity security as an IAM-only problem.
An identity event becomes much more valuable when combined with other telemetry.
Consider:
Identity
User successfully authenticates.
↓
Endpoint
The user’s workstation launches an unusual PowerShell process.
↓
Network
The workstation establishes an outbound connection to a previously unseen destination.
↓
Identity
The same account accesses another internal system.
↓
File activity
Large volumes of sensitive files are accessed.
Individually, these events may be explainable.
Together, they tell a story.
This is the core principle of modern Blue Team operations:
Detection is not about finding one bad event. It is about recognizing a sequence of events that makes sense as an attack.
What Happens When the SOC Confirms Compromise?
Detection is only the beginning.
Once an identity is considered compromised, the response process may include:
- Confirm the suspicious activity.
- Identify the affected account.
- Determine when the compromise began.
- Review authentication history.
- Identify systems accessed by the account.
- Investigate endpoint activity.
- Look for privilege escalation.
- Search for persistence.
- Identify potential data access or exfiltration.
- Revoke sessions and credentials.
- Reset or rotate affected credentials.
- Continue monitoring for related activity.
This is where SIEM and SOAR capabilities can work together.
The SIEM provides the visibility and investigation context.
SOAR can help standardize and automate repetitive response actions through cases and playbooks.
Logstail’s Security Suite brings these capabilities together, connecting SIEM monitoring with alert management, case workflows, and automated playbooks.
The Human Element Still Matters
Technology alone cannot solve identity security.
A detection may identify an unusual authentication event, but an analyst still needs to determine whether the behavior is legitimate.
For example:
A user logs in from another country.
Is it:
- A compromised account?
- A business trip?
- A VPN?
- A corporate proxy?
- A cloud service?
- A false positive?
Context matters.
This is why effective Blue Teams combine technology with skilled analysts, documented investigation processes, and continuous training.
Logstail approaches cybersecurity as a broader operating model that combines security operations, exposure management, and cyber readiness rather than treating detection as an isolated function.
The New Question for Blue Teams
The traditional security mindset was often:
“Can we detect malware?”
Modern organizations need to ask a broader question:
“Can we detect an attacker who looks like a legitimate user?”
That requires visibility across identity, endpoints, applications, networks, and cloud environments.
It requires strong authentication controls.
It requires effective detection engineering.
And it requires a SOC capable of turning thousands of individual events into a coherent attack story.
Conclusion
Attackers do not always need malware. Sometimes, they only need a username, a password, a session, or a compromised identity. That is what makes identity-based attacks so challenging: the authentication system may report a successful login, the application may see a valid user, and the endpoint may initially show nothing malicious.
The difference is often revealed by the surrounding behavior. Where did the login originate? Does it match the user’s normal activity? What systems were accessed afterward, and what happened next? For Blue Teams, identity security is therefore not simply about preventing unauthorized authentication, but about continuously evaluating whether legitimate authentication is being used for malicious purposes.
Modern detection requires security teams to connect identity, endpoint, network, application, and user-behavior signals into a coherent picture. With the right SIEM, detection engineering, investigation processes, and automated response capabilities, organizations can move beyond isolated alerts and identify attack patterns before they become larger security incidents.
The attacker may not need to break in anymore. They may already have the credentials to sign in.
Logstail helps organizations turn these signals into operational security through SIEM monitoring, detection, investigation, automation, and response—helping security teams move from isolated alerts toward a more connected and actionable view of threats.