We will explore prevalent hacker techniques through the MITRE ATT&CK framework and methods to protect privileged identities. Through the analysis of significant cyber incidents, we will examine how hackers frequently utilize lateral movement within IT systems to achieve privilege escalation and gain Domain Admin access. The presentation will specifically highlight the use of remote monitoring tools such as RDP, AnyDesk, TeamViewer, among others, in systems lacking an AD Tiering model, facilitating the spread of ransomware across multiple computers. Strategies and best practices using Sentinel and Defender for monitoring privileged users will be demonstrated, emphasizing the importance of implementing a Tiering model for maximum security and protection against suspicious hacker activities. We will conclude with examples of how altering security policies and procedures can prevent hackers from leveraging the identity system as a leverage point for ransomware propagation.