How do I write custom detection rules for lateral movement inside an Active Directory domain using native Windows logging features
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
How do I write custom detection rules for lateral movement inside an Active Directory domain using native Windows logging features
1 real search · 1 real-search pass
Microsoft Windows Security auditing event 4624 4648 4688 4697 4769 documentation audit policy Windows Event ForwardingGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 1 queries…
Searches and sources
ChatGPT1 real searches · gpt-6
Microsoft Windows Security auditing event 4624 4648 4688 4697 4769 documentation audit policy Windows Event Forwarding Google ↗
- Advanced Audit Policy Configuration reference · learn.microsoft.com
- 4624(S) An account was successfully logged on. - Windows 10 · learn.microsoft.com
- Windows Event Collector · learn.microsoft.com
- Microsoft: Event 4624 documentation · learn.microsoft.com
- Microsoft: Get-WinEvent · learn.microsoft.com