SentinelOne Singularity Identity — ITDR, AD Protection & Deception

① Why ITDR matters — Active Directory is the breach highway

In the majority of major breaches, the attacker's first goal after initial access is to reach Active Directory. Control one privileged AD account and you can move laterally, escalate to Domain Admin, dump credentials, and own the entire estate. The same is true of Entra ID (formerly Azure AD) for cloud and hybrid environments.

ITDR was created to fill the gap between EDR (which watches process and file behaviour) and traditional IAM (which manages who has access). ITDR watches what accounts and identity systems actually do — real-time queries, ticket requests, replication calls — and raises alerts when the pattern looks like a credential attack.

SentinelOne Singularity Identity delivers ITDR from the same agent as the Singularity EDR, so identity and endpoint telemetry are correlated in a single alert timeline. The result: an attacker doing a Kerberoast on the network while also touching a suspicious process shows up as one story, not two disconnected events.

② Harden the surface — finding & closing AD exposures before attackers do

Singularity Identity continuously assesses your AD and Entra ID for the misconfigurations attackers hunt for. It surfaces exposures like Kerberoastable accounts (service accounts with SPNs and weak passwords), unconstrained delegation (a setting that lets any service impersonate any user), AS-REP Roastable accounts (accounts with pre-auth disabled), stale privileged accounts, and passwords stored in AD attributes such as the Description field.

Identity posture scoring

Each exposure is scored by exploitability and blast radius. The platform maps the identity attack surface against real attacker techniques (MITRE ATT&CK), so a security team can prioritise remediation: fix the three accounts that would give an attacker a direct path to Domain Admin first, rather than chasing a long tail of low-risk issues.

Hardening is not a one-time scan. Singularity Identity monitors continuously, raising a new finding the moment a mis-configuration reappears — for example when a helpdesk ticket re-enables pre-auth exemption on a service account.

③ Detect & respond — catching credential attacks in real time

Detection in Singularity Identity is agent-based and happens on domain controllers, domain-joined endpoints, and cloud identity providers simultaneously. The most important attacks it catches in real time include:

• DCSync — an attacker impersonates a domain controller to pull password hashes from AD replication. Singularity Identity sees the replication call and fires an alert immediately.
• Pass-the-Hash / Pass-the-Ticket — reusing a stolen NTLM hash or Kerberos ticket to authenticate without knowing the password.
• Kerberoasting — requesting service tickets for Kerberoastable SPNs and cracking them offline.
• Golden Ticket / Silver Ticket — forging Kerberos tickets using a compromised KRBTGT hash to gain persistent, privileged access.
• AS-REP Roasting — extracting encrypted AS-REP responses for accounts with pre-auth disabled and cracking offline.
• LDAP reconnaissance — automated enumeration of AD users, groups, and OUs by attacker tooling like BloodHound.

When a detection fires, the agent can automatically respond: blocking the offending host from authenticating, isolating the endpoint, or injecting a deceptive response to mislead the attacker — without waiting for a human to act.

④ Deceive & disrupt — fake credentials, decoys and the Hologram network

Deception is Singularity Identity's most distinctive capability. The platform plants deceptive credentials in the places attackers harvest them: browser credential stores, Windows Credential Manager, macOS keychain, and password managers. The moment an attacker's tool reads one of these fake entries and tries to use it, Singularity Identity fires a high-fidelity alert — no tuning, no false positives, because no legitimate user ever touches a deceptive credential.

Singularity Hologram — network-wide decoys

Singularity Hologram extends deception beyond credentials to the network layer. It projects fake hosts, services and data across the environment — so when an attacker does lateral-movement reconnaissance they encounter decoy servers that look real but lead nowhere productive. Every interaction with a Hologram decoy is a guaranteed true positive.

The combined effect: an attacker who evades initial detection by using a legitimate stolen credential will eventually touch a fake one, trigger the deception layer, and expose their full attack path — giving the SOC a complete picture for containment and forensics.