← Cyber Intelligence Foundations
Module 1: Start With the Decision
From Security Data to Intelligence Write an Intelligence Requirement
Module 2: Build an Evidence Base
Collect Evidence With a Plan Evaluate Sources and Claims
Module 3: Analyze, Report, and Improve
Describe Adversary Behavior Without Overclaiming Indicators of Compromise and Their Types Use Indicators With Context Write and Review a Decision-Ready Assessment
Module 4: Turn Intelligence Into Better Defense
Build a Bounded Defensive Hunt Keep Intelligence Useful Over Time
Module 5: Apply Intelligence to Common Security Problems
Build Vulnerability Intelligence That Prioritizes Action Analyze Identity and Social-Engineering Threats Analyze Malware and Ransomware Activity
Module 6: Operate Intelligence as a Capability
Work With Stakeholders and Decision-Makers Govern Intelligence and Handle Information Responsibly Share Structured Intelligence and Automate Safely
Module 5: Apply Intelligence to Common Security Problems

Analyze Identity and Social-Engineering Threats

Investigate phishing and account abuse as behavior chains rather than isolated messages or login events.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

  • Analyze identity and social-engineering activity as a sequence of observable behaviors with appropriate privacy and confidence limits.

Analyze Identity and Social-Engineering Threats

This lesson applies intelligence thinking to identity-centric attacks. You will connect lures, authentication events, mailbox changes, and access patterns while protecting privacy and avoiding assumptions based on one suspicious signal.

Follow the Attack Chain Across Telemetry

Identity-driven attacks often look ordinary when each event is viewed alone. A message may resemble a routine invoice. A sign-in may come from a legitimate cloud provider. A mailbox rule may have been created by an administrator. Intelligence emerges when the events are joined in time and context: a targeted lure, a new sign-in pattern, a consent grant, a forwarding rule, and access to sensitive mail.

Build a timeline without assuming the conclusion. Record the message delivery time, link or attachment, authentication result, device or location context, privilege change, and subsequent access. Ask which events are directly observed and which are inferred. A user traveling can explain a new location, but it may not explain a new forwarding rule immediately afterward.

Protect personal data while investigating. Use the minimum identity information needed for the requirement, restrict access to sensitive records, and separate a user’s normal travel or work pattern from unnecessary profiling. A useful intelligence workflow improves account protection without turning ordinary behavior into suspicion.

Identity attack chain across telemetryA timeline connects message, sign-in, consent, mailbox, and data-access events for identity investigation. IDENTITY INTELLIGENCELook for the sequence, not one event LUREmessageSIGN-INauth eventCONSENTapp grantRULEforwardingACCESSmail/dataCorrelate time, user, device, privilege, and data access.Each event needs its own evidence; the sequence creates the investigative hypothesis.
Identity attack chain across telemetry — Message, authentication, consent, mailbox, and access events form a timeline that analysts can test without assuming the conclusion.

Turn the Assessment Into Safer Controls

The best response to social engineering is rarely one control. Use the intelligence to choose layered actions: improve phishing-resistant authentication, constrain risky consent, alert on mailbox-rule changes, preserve message evidence, tune user reporting, and prepare an account-recovery path. Match the control to the behavior you observed and state the owner.

Avoid victim-blaming language. A convincing message exploits process and technology as well as human attention. Reporting should make it easy for a user to raise a concern, and response teams should explain what evidence they need without asking users to investigate the attacker themselves. The goal is safer detection and recovery, not a story about individual fault.

Measure whether the change helps. Track reporting time, time to revoke unauthorized access, coverage of mailbox audit events, false-positive rate, and repeat patterns. Use these measures as feedback to the requirement. If the team cannot see the relevant event, the intelligence product should say so and prioritize telemetry before promising a precise detection.

Layered controls for identity threatsFour connected control layers show prevention, detection, response, and recovery for identity threats. CONTROL DESIGNUse intelligence to layer the responsePREVENTphishing-resistantauthenticationDETECTconsent + rulechange alertsRESPONDrevoke + preserveevidenceRECOVERrestore accountlearn + improve
Layered controls for identity threats — Prevention, detection, response, and recovery controls address different stages of an identity-centered social-engineering attack.
← Previous: Build Vulnerability Intelligence That Prioritizes Action Next: Analyze Malware and Ransomware Activity →