We suspect an attacker is moving laterally using pass-the-hash techniques so what immediate containment steps should our incident response team take right now
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
We suspect an attacker is moving laterally using pass-the-hash techniques so what immediate containment steps should our incident response team take right now
1 real search · 1 real-search pass
CISA Microsoft incident response guidance pass the hash lateral movement containment NTLM compromised credentials isolate systemsGoogle ↗
OBSERVEDConsequence
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
ChatGPT real searches (1)
Classes come from the query-classifier (a local Laya model).
Searches and sources
ChatGPT1 real searches · gpt-6
CISA Microsoft incident response guidance pass the hash lateral movement containment NTLM compromised credentials isolate systems Google ↗
- T1550.002 – Pass the Hash · attack.mitre.org
- Incident response overview · learn.microsoft.com
- Microsoft Incident Response ransomware approach and best practices · learn.microsoft.com
- CYBERSECURITY & INFRASTRUCTURE · cisa.gov
- CYBERSECURITY & INFRASTRUCTURE · cisa.gov
- CISA – Incident Response Resources · cisa.gov
- Microsoft – Windows LAPS · learn.microsoft.com