Detection rule
Possible overpass-the-hash detection (T1550.002)
A sign-in used an RC4 key for an account that has AES keys. Without the 2025 Kerberos fields on a domain controller, the rule relies on the account's msDS-SupportedEncryptionTypes attribute, which is usually unset on user accounts, so most users aren't checked. GraphnAI raises an alert when it sees this in your domain controllers' security events.
How GraphnAI finds it
An OpenTelemetry collector sends the Windows Security log from your domain controllers to your GraphnAI server. GraphnAI checks each batch of events against every active rule.
This rule reads one event:
- 4768A Kerberos authentication ticket (TGT) was requested
One matching event raises the alert.
The alert shows the account's type and tier, and how many of its paths to Tier 0 are Validated.
Tiered Fidelity™ level: Validated
Telemetry saw the activity itself, so GraphnAI marks the targeted account with an alert edge at the Validated level.
- TheoreticalConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedThis alertTelemetry has seen it in use.
How you respond with Select Fire™
The alert has no Select Fire button, because the account it names is one an attacker can choose.
- Full-AutoTriage never acts on it automatically. An attacker chooses the accounts it names, so acting on one would let the attacker pick the account to lock out.
MITRE ATT&CK® technique names: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation.
See what's hitting your identities.
The Public Preview is free for 30 days from your first sync, on your own server.