Unique Identifiers for Authentication Function (Monitoring)

The practice requires the mission to define indicators of users, privileged users included, posing significant risk in a mission-specific context. Behavioural indicators are the detection that survives correct credentials, which is what credentialed evasion otherwise defeats.

Traversal on legitimate credentials is in scope for user risk indicators, though the practice defines what to watch for rather than mediating the boundary crossings themselves.

Persistence on valid credentials is detected by the risk indicators the practice requires, not by authentication, which the adversary passes.