Detections
Identity threat detections, rule by rule.
Every rule GraphnAI runs on the Security log of your domain controllers. Each page gives its MITRE ATT&CK technique, the Windows events it reads, its threshold, and how you respond with Select Fire.
As of GraphnAI v0.5.1-rc.3, the current release.
All detection rules
- 15active rules
- 8Critical
- 12ATT&CK techniques
- An OpenTelemetry collector sends the Security log to your GraphnAI server, and each batch of events runs against every rule.
- An alert that names an account shows its type and tier, and how many of its paths to Tier 0 are Validated.
No rules match these filters.
Attack rules 12
Each matches a pattern in the events themselves, inside a time window or on a single event.
- Critical
AS-REP Roasting
AS-REP requests without pre-authentication from one source.
- Critical
Audit tampering
Audit policy changed.
- Critical
DCSync
Directory replication by an account that isn't a domain controller.
- Critical
Golden Ticket
TGT issued with RC4 encryption.
- Critical
Kerberoasting
Many RC4 service ticket requests from one account.
- Critical
Password spray succeeded
Successful authentication from an address that was spraying passwords.
- Critical
Tier 0 group change
Member added to a Tier 0 group.
- Critical
Trust manipulation
Domain trust created, changed, or removed.
- High
Account manipulation
Password reset or account enabled by another account.
- High
Brute force
Many failed logons to one account.
- High
Lateral movement
Network logons (type 3) by one account across several hosts in turn.
- High
Password spray
Failed logons to many accounts from one source.
Behavior rules 3
Each compares a logon with the identity's own baseline from the last 30 days.
- Medium
Unusual authentication protocol
Authentication with a protocol this identity rarely uses.
- Medium
Unusual logon hour
Logon at an hour when this identity doesn't usually log on.
- Medium
Unusual source host
Logon from a host this identity doesn't usually use.
Posture checks that close the exposures these attacks use How detection and triage work
MITRE ATT&CK® technique names: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation.
See what's hitting your identities.
The Public Preview is free for 30 days from your first sync, on your own server.