Identity Threats and Where to Find Them: Mapping ITDR and MITRE ATT&CK

Modern cyber threats increasingly bypass traditional security controls, with attackers exploiting weakly secured identities instead of relying on sophisticated exploits. This shift has made identity-based threats a critical attack vector, necessitating specialized defense mechanisms. Identity Threat Detection and Response (ITDR) has emerged as a new security discipline designed to detect and mitigate these threats before they escalate. Despite its growing importance, ITDR lacks a structured, vendor-independent framework for understanding the threats it addresses. This paper aims to systematize knowledge on identity threats, examining how they impact different stages of the digital workforce identity lifecycle and identifying the methods available to detect and respond to them. To achieve this, we conducted a comprehensive analysis of identity threats within the MITRE ATT&CK framework. We identified 366 identity-related threats and developed a framework to categorize them based on their impact across the digital identity lifecycle, evaluating corresponding detection and response mechanisms. This research provides a foundational understanding of ITDR, contributing to its development as a formal security discipline and offering practical insights for organizations aiming to strengthen identity security in enterprise environments.