Looking for actionable strategies to detect lateral movement within an active directory environment using advanced network behavioral analytics and EDR data.
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
Looking for actionable strategies to detect lateral movement within an active directory environment using advanced network behavioral analytics and EDR data.
3 real searches · 1 real-search pass
Microsoft Defender for Identity lateral movement detection sensors security alerts advanced hunting documentation Active DirectoryGoogle ↗
OBSERVEDReason
MITRE ATT&CK lateral movement detection Windows event logs Kerberos SMB RDP officialGoogle ↗
OBSERVEDConsequence
Microsoft Windows security auditing event 4624 4769 4776 documentationGoogle ↗
OBSERVEDReason
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
ChatGPT real searches (3)
Classes come from the query-classifier (a local Laya model). 3 of 3 calls are low-confidence (under 50%) — hover a query in the table to see its confidence.
Searches and sources
ChatGPT3 real searches · gpt-6
Microsoft Defender for Identity lateral movement detection sensors security alerts advanced hunting documentation Active Directory Google ↗
MITRE ATT&CK lateral movement detection Windows event logs Kerberos SMB RDP official Google ↗
Microsoft Windows security auditing event 4624 4769 4776 documentation Google ↗
- MITRE ATT&CK knowledge base · attack.mitre.org
- Event 4624 · learn.microsoft.com
- Multi-Event Detection for SMB Admin Share Lateral Movement, Detection Strategy DET0530 · attack.xn--zsss51h.xn--rhqv96g
- Exploitation of Remote Services – multi-platform lateral movement detection, Detection Strategy DET0118 · attack.mitre.org
- Security alerts - Microsoft Defender for Identity · learn.microsoft.com
- Microsoft Defender for Identity XDR security alerts - Microsoft Defender for Identity · learn.microsoft.com
Queries
3 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
Microsoft Defender for Identity lateral movement detection sensors security alerts advanced hunting documentation Active Directory OBSERVED | Google ↗ AI Mode ↗ | — | Reason | — | — | 1x of 1 | |
MITRE ATT&CK lateral movement detection Windows event logs Kerberos SMB RDP official OBSERVED | Google ↗ AI Mode ↗ | — | Consequence | — | — | 1x of 1 | |
Microsoft Windows security auditing event 4624 4769 4776 documentation OBSERVED | Google ↗ AI Mode ↗ | — | Reason | — | — | 1x of 1 |