In a typical identity infrastructure attack, advisories target regular user accounts or endpoints for the initial breach. The reason is high privileged accounts and highly important systems have advanced protection compared to end user devices. These systems and accounts are constantly monitored and there is a high possibility that engineers recognize unauthorized login attempts or unusual behavior quickly. A typical end user account does not have privileges to do much damage, but the privileged account does, so the next thing they are looking for is to get their hands on the privileged account.
If they start to misbehave with the system, the user will contact the IT department for help. IT department engineers ...
