Autonomous AI Agent Credential Harvesting Campaign: Defending Identity Against Machine-Speed Attacks (GTIG 2026)

---
title: High-Volume Failed Network Authentications From Single Source
description: Detects a single source generating failed logons against multiple distinct accounts within a short window, consistent with AI-orchestrated password spraying that spreads attempts across many accounts while reusing infrastructure. Tune the per-source aggregation in your SIEM pipeline.
status: experimental
references:
  - https://thehackernews.com/2026/09/autonomous-ai-agents-compromise.html
  - https://attack.mitre.org/techniques/T1110/003/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1110.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    LogonType:
      - 3
      - 10
    SubStatus: '0xC000006A'
  filter_known_sprays:
    IpAddress:
      - '127.0.0.1'
      - '-'
  condition: selection and not filter_known_sprays
falsepositives:
  - Misconfigured service accounts with stale credentials
  - Mobile email clients with expired passwords
level: medium
---
title: LSASS Memory Access By Non-System Process
description: Detects credential dumping attempts against LSASS memory, a likely post-compromise step after AI-agent credential campaigns achieve initial access. Legitimate access is limited to a small set of system and security tooling processes.
status: experimental
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1fffff'
  filter_system:
    SourceImage|endswith:
      - '\wininit.exe'
      - '\csrss.exe'
      - '\MsMpEng.exe'
      - '\svchost.exe'
  condition: selection and not filter_system
falsepositives:
  - EDR and DLP tooling with legitimate LSASS inspection
  - Backup and forensic agents
level: high
---
title: Browser Credential Store Access By Non-Browser Process
description: Detects non-browser processes reading Chromium or Firefox credential databases (Login Data, Cookies, logins.json), a common technique for harvesting additional credentials and session tokens after initial access. AI-agent campaigns that validate stolen browser-stored credentials make this a high-value post-compromise signal.
status: experimental
references:
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Web Data'
      - '\logins.json'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
      - '\MsMpEng.exe'
  condition: selection_paths and not filter_browsers
falsepositives:
  - EDR/AV scanning of browser profiles
  - Enterprise password managers or backup agents
level: high

// Machine-speed password spray / credential stuffing detection
// Looks for sources failing auth against many distinct users in a 10-minute bin,
// then checks whether any success followed from the same source IP.
let window = 10m;
let failureThreshold = 15;   // distinct users failing from one IP per window
let failures = SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != 0
| summarize
    FailedUsers = dcount(UserPrincipalName),
    FailedUserList = make_set(UserPrincipalName, 50),
    FailureCount = count(),
    Apps = make_set(AppDisplayName, 10)
    by IPAddress, bin(TimeGenerated, window)
| where FailedUsers >= failureThreshold;
let successes = SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| project SuccessTime = TimeGenerated, IPAddress, UserPrincipalName, AppDisplayName,
    UserAgent, LocationDetails;
failures
| join kind=leftouter successes on IPAddress
| extend SprayThenSuccess = SuccessTime between (TimeGenerated .. TimeGenerated + 2h)
| project TimeGenerated, IPAddress, FailedUsers, FailureCount, Apps,
    SprayThenSuccess, SuccessTime, UserPrincipalName, AppDisplayName, LocationDetails
| order by FailedUsers desc;

// Hunt for non-browser processes touching Chromium credential stores
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("Login Data", "Cookies", "Web Data")
| where FolderPath has_any ("\\Google\\Chrome\\", "\\Microsoft\\Edge\\", "\\BraveSoftware\\")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "brave.exe", "MsMpEng.exe")
| where InitiatingProcessFileName !endswith ".tmp"
| summarize FileHits = count(),
    Files = make_set(FileName, 10)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by FileHits desc;

-- Fleet-wide hunt: processes accessing browser credential stores or
-- holding suspicious numbers of outbound TLS connections to IdP endpoints
SELECT Pid, Name, Exe, CommandLine, Username,
       CreateTime,
       read_file(filename=Exe, length=0) AS _ExeExists
FROM pslist()
WHERE CommandLine =~ '(?i)(login data|cookies|logins\.json|key4\.db|ntds\.dit|lsass)'
   OR Exe =~ '(?i)(temp|tmp|appdata\\\\local\\\\temp|programdata\\\\[^\\\\]+\.(exe|bat|ps1))'

-- Identify endpoints with abnormally high concurrent outbound 443 connections
-- from a single non-browser process (credential validation at machine speed)
SELECT Pid, Name, Status,
       count(group=Pid) AS ConnCount,
       set(items=RemoteAddress.IP, maximum=20) AS RemoteIPs
FROM netstat()
WHERE RemotePort = 443
  AND Status =~ 'ESTAB'
  AND Name !~ '(?i)(chrome|msedge|firefox|brave|teams|onedrive|outlook|svchost)'
GROUP BY Pid, Name, Status
HAVING ConnCount > 40
ORDER BY ConnCount DESC

# Requires: Microsoft.Graph PowerShell SDK, scopes: User.Read.All,
#           UserAuthenticationMethod.Read.All, AuditLog.Read.All, Policy.Read.All
# Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes "User.Read.All","UserAuthenticationMethod.Read.All","AuditLog.Read.All","Policy.Read.All"

# 1. Report users WITHOUT phishing-resistant MFA methods registered
$weakMethods = @("password", "sms", "voice")
$users = Get-MgUser -All -Property "Id,DisplayName,UserPrincipalName,AccountEnabled" | Where-Object AccountEnabled -eq $true
$report = foreach ($u in $users) {
    $methods = (Get-MgUserAuthenticationMethod -UserId $u.Id -ErrorAction SilentlyContinue).AdditionalProperties.'@odata.type'
    $strong = $methods | Where-Object { $_ -match 'fido2|windowsHello|microsoftAuthenticator|certificateBased' }
    [PSCustomObject]@{
        User            = $u.UserPrincipalName
        StrongMFA       = [bool]$strong
        RegisteredTypes = ($methods -replace '#microsoft.graph.','') -join ';'
    }
}
$report | Where-Object { -not $_.StrongMFA } | Export-Csv -Path ".\Users_Without_PhishingResistantMFA.csv" -NoTypeInformation
Write-Host "Users lacking phishing-resistant MFA: $(( $report | Where-Object { -not $_.StrongMFA } ).Count) / $($users.Count)" -ForegroundColor Yellow

# 2. Flag legacy-auth sign-ins in the last 7 days (bypass Conditional Access)
$start = (Get-Date).AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
$legacy = Get-MgAuditLogSignIn -All -Filter "createdDateTime ge $start" -Property "ClientAppUsed,Status,IPAddress,UserPrincipalName" |
    Where-Object { $_.ClientAppUsed -in @("Exchange ActiveSync","IMAP","POP3","SMTP","MAPI Over HTTP","Other clients") -and $_.Status.ErrorCode -eq 0 }
$legacy | Select-Object CreatedDateTime, UserPrincipalName, IPAddress, ClientAppUsed |
    Export-Csv -Path ".\LegacyAuth_Successes_7d.csv" -NoTypeInformation
Write-Host "Successful legacy-auth sign-ins (7d): $($legacy.Count)" -ForegroundColor Red

# 3. Verify a Conditional Access policy blocks legacy authentication
$caPolicies = Get-MgIdentityConditionalAccessPolicy
$legacyBlock = $caPolicies | Where-Object {
    $_.Conditions.ClientAppTypes -contains "exchangeActiveSync" -or
    $_.Conditions.ClientAppTypes -contains "other"
} | Where-Object { $_.GrantControls.BuiltInControls -contains "block" -and $_.State -eq "enabled" }
if (-not $legacyBlock) {
    Write-Host "WARNING: No enabled CA policy blocking legacy authentication found. Create one immediately." -ForegroundColor Red
} else {
    Write-Host "Legacy auth block CA policy present: $($legacyBlock.DisplayName -join ', ')" -ForegroundColor Green
}