Detections
Identity threat detections, rule by rule.
Every rule GraphnAI runs on the Security log of your domain controllers. Each page gives its MITRE ATT&CK technique, the Windows events it reads, its threshold, and how you respond with Select Fire.
As of GraphnAI v0.5.1-rc.4, the current release.
All detection rules
- 21active rules
- 9Critical
- 16ATT&CK techniques
- An OpenTelemetry collector sends the Security log to your GraphnAI server, and each batch of events runs against every rule.
- An alert that names an account shows its type and tier, and how many of its paths to Tier 0 are Validated.
No rules match these filters.
Attack rules 18
Each matches a pattern in the events themselves, inside a time window or on a single event.
- Critical
AS-REP Roasting
AS-REP requests without pre-authentication from one source.
- Critical
Audit tampering
Audit policy changed.
- Critical
DCSync
Directory replication by an account that isn't a domain controller.
- Critical
Golden Ticket
A Kerberos ticket that no domain controller issued: a service ticket presented with a ticket-granting ticket that has no issuance, a renewal that chains to none, or a forged ticket the domain controller refused.
- Critical
Kerberoasting
Many RC4 service ticket requests from one account.
- Critical
Password spray succeeded
Successful authentication from an address that was spraying passwords.
- Critical
SID history injection
SID History added to an account.
- Critical
Tier 0 group change
Member added to a Tier 0 group.
- Critical
Trust manipulation
Domain trust created, changed, or removed.
- High
Account manipulation
Password reset or account enabled by another account.
- High
Brute force
Many failed logons to one account.
- High
Lateral movement
One account signed in from computer to computer, reaching three within four hours. Computers are matched to addresses by their own recent logons; a shared address isn't matched.
- High
Password spray
Failed logons to many accounts from one source.
- High
Security log cleared
The Security event log was cleared on a computer. Critical on a domain controller, High elsewhere. If the event carries no user data, the account that cleared it isn't shown.
- Medium
Directory enumeration
One account read many directory objects in a short time. Windows logs these reads only for objects with auditing turned on, so reads of other objects aren't seen.
- Medium
Pass-the-Hash
An account's password hash was used instead of its password: credentials swapped on a host and then used, or NTLM from a computer that normally uses Kerberos for this account.
- Medium
Possible overpass-the-hash
A sign-in used an RC4 key for an account that has AES keys. Without the 2025 Kerberos fields on a domain controller, the rule relies on the account's msDS-SupportedEncryptionTypes attribute, which is usually unset on user accounts, so most users aren't checked.
- Low
Account created and enabled
A user account was created and is enabled, or was created and then enabled or given a password within 24 hours. It is Medium when SYSTEM or a machine account created it, or the new account's name ends in $.
Behavior rules 3
Each compares a logon with the identity's own baseline from the last 30 days.
- Medium
Unusual authentication protocol
Authentication with a protocol this identity rarely uses.
- Medium
Unusual logon hour
Logon at an hour when this identity doesn't usually log on.
- Medium
Unusual source host
Logon from a host this identity doesn't usually use.
Posture checks that close the exposures these attacks use How detection and triage work
MITRE ATT&CK® technique names: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation.
See what's hitting your identities.
The Public Preview is free for 30 days from your first sync, on your own server.