---
title: "Discussion on \"Anatomy of an identity compromise\" | Hashnode"
description: "Discussion on \"Anatomy of an identity compromise\". A login-only intrusion, step by step, and where the detection actually lives"
url: "https://hashnode.com/posts/anatomy-of-an-identity-compromise/6a8435894bf6c7f3da41b104"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Anatomy of an identity compromise](https://kajalbuilds.hashnode.dev/anatomy-of-an-identity-compromise?utm_source=hashnode&utm_medium=feed)

A login-only intrusion, step by step, and where the detection actually lives

Aug 18 · 12 min read · kajalbuilds.hashnode.dev  
Updated Oct 11  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#entra-id](https://hashnode.com/tag/entra-id)
-   [#microsoft-entra-id](https://hashnode.com/tag/microsoft-entra-id)
-   [#azure-active-directory](https://hashnode.com/tag/azure-active-directory)
-   [#incident-response](https://hashnode.com/tag/incident-response)
-   [#microsoft-365](https://hashnode.com/tag/microsoft-365)
-   [#blue-team](https://hashnode.com/tag/blue-team)
-   [#detection-engineering](https://hashnode.com/tag/detection-engineering)

## Written by

[Kajal Dhanjal](https://hashnode.com/@kajalbuilds)

@kajalbuilds · Melbourne VIC

  
[View profile](https://hashnode.com/@kajalbuilds)

I write about detection and identity for security vendors and MSPs. ICT Support Technician@ JB Hifi and a Cybersecurity Master's student, AISA Cyber Security Awards 2026 finalist.

I write about detection and identity. Specifically, the gap between what a security control is assumed to prove and what it actually proves, and what that gap looks like in the logs. Recent posts cover the blind spots built into nine common log sources, the anatomy of an identity compromise through Entra and M365 telemetry, and the MITRE ATT&CK detection layer that was retired in 2025. Two rules hold across everything here. Every factual claim is sourced to primary documentation, meaning vendor technical docs, standards bodies or government advisories, never vendor marketing. Lab work is labelled as lab work. I am a cybersecurity Master's student in Melbourne and a finalist in the AISA Cyber Security Awards 2026, Student of the Year category. I build and publish ATT&CK mapped detections in a public Microsoft Sentinel lab. I take paid writing commissions from security vendors and MSPs.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.