O'Reilly logo
  • Moses Chung thinks this is interesting:

In a typical identity infrastructure attack, advisories target regular user accounts or endpoints for the initial breach. The reason is high privileged accounts and highly important systems have advanced protection compared to end user devices. These systems and accounts are constantly monitored and there is a high possibility that engineers recognize unauthorized login attempts or unusual behavior quickly. A typical end user account does not have privileges to do much damage, but the privileged account does, so the next thing they are looking for is to get their hands on the privileged account.

From

Cover of Mastering Active Directory

Note

adversaries?