Closing the Exposure-to-Breach Gap: Defending Against AI-Accelerated Credential Leaks and Exploit Weaponization

---
title: Authentication From High-Risk ASN or Hosting Provider Against Remote Access Portal
id: 8c2f4a71-3b6d-4e59-a1c7-9d2e5f8b3a41
status: experimental
description: Detects successful authentication to VPN, SSO, or remote access services originating from hosting providers, VPS ranges, or anonymization networks — a strong indicator of leaked credential validation and abuse.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1110/004/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1110.004
logsource:
  category: authentication
  product: windows
detection:
  selection:
    LogonType:
      - 3
      - 10
  filter_known_users:
    TargetUserName|endswith:
      - '$'
      - 'ANONYMOUS LOGON'
  condition: selection and not filter_known_users
falsepositives:
  - Legitimate remote users on corporate VPN egressing through cloud gateways — baseline known egress IPs and suppress
level: high
---
title: Web or Remote Access Service Process Spawning Command Shell
id: 3e7b9c24-6a1f-4d82-b5e8-2c4a7f901d36
status: experimental
description: Detects web servers, VPN services, or remote access daemons spawning command interpreters or scripting engines — a classic post-exploitation indicator following rapid weaponization of a disclosed vulnerability.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat9.exe'
      - '\sqlservr.exe'
      - '\vpnserver.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate application integrations invoking shells — investigate parent service and command line before suppressing
level: critical
---
title: Multiple Failed Authentications Followed By Success From Same Source
id: 5a1d8e63-9c4b-4f27-a3e6-7b2d9f4c8e15
status: experimental
description: Detects credential stuffing or password spraying patterns — repeated failed logons from a single source followed by a successful authentication, consistent with leaked credential validation.
references:
  - https://attack.mitre.org/techniques/T1110/
author: Security Arsenal
date: 2026/09/02
tags:
  - attack.credential_access
  - attack.t1110
logsource:
  category: authentication
  product: windows
detection:
  selection_fail:
    EventID: 4625
  selection_success:
    EventID: 4624
  condition: selection_fail and selection_success
  timeframe: 10m
falsepositives:
  - Users mistyping passwords then succeeding — tune with threshold counts and source IP correlation in your SIEM
level: medium

// Hunt: Successful sign-ins from never-before-seen ASN or country per user
// Baseline: 30 days of history; Flag: last 24 hours
let lookback = 30d;
let window = 24h;
let HistoricalSignIns = SigninLogs
    | where TimeGenerated between (ago(lookback) .. ago(window))
    | where ResultType == 0
    | summarize HistoricalASNs = make_set(NetworkLocationDetails), HistoricalCountries = make_set(LocationDetails.countryOrRegion) by UserPrincipalName;
SigninLogs
| where TimeGenerated > ago(window)
| where ResultType == 0
| extend Country = tostring(LocationDetails.countryOrRegion), ASN = tostring(NetworkLocationDetails.networkNames)
| summarize arg_max(TimeGenerated, *) by UserPrincipalName, IPAddress
| join kind=leftouter HistoricalSignIns on UserPrincipalName
| where HistoricalCountries !has Country or isempty(HistoricalCountries)
| where IPAddress !startswith "10." and IPAddress !startswith "192.168." and IPAddress !startswith "172.16."
| project TimeGenerated, UserPrincipalName, IPAddress, Country, AppDisplayName, DeviceDetail, AuthenticationRequirement
| order by TimeGenerated desc;

// Hunt: Internet-facing service processes spawning shells or LOLBins (24h)
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat9.exe", "sqlservr.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "mshta.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;

-- Hunt: Shells spawned by web/remote-access service processes (post-exploitation indicator)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(cmd\.exe|powershell|pwsh|rundll32|certutil|mshta)'
  AND (
    get_member(member='Ppid') IN (
      SELECT Pid FROM pslist()
      WHERE Name =~ '(w3wp|httpd|nginx|tomcat|sqlservr)'
    )
  )

-- Hunt: Recently created persistence artifacts (Run keys, scheduled tasks, services) in last 7 days
SELECT Name, FullPath, Mtime, Size
FROM glob(globs=['C:/Windows/System32/Tasks/**'], accessor='file')
WHERE Mtime > now() - (7 * 24 * 3600)
ORDER BY Mtime DESC

# Requires: ActiveDirectory module, run as Domain Admin or delegated equivalent
# Purpose: Identify and remediate high-risk accounts following leaked credential exposure

$StaleThresholdDays = 90
$ReportPath = "C:\IR\HighRiskAccounts_$(Get-Date -Format 'yyyyMMdd').csv"
New-Item -ItemType Directory -Path "C:\IR" -Force | Out-Null

# 1. Find privileged accounts with passwords older than threshold
$PrivilegedGroups = @("Domain Admins", "Enterprise Admins", "Administrators")
$HighRisk = foreach ($Group in $PrivilegedGroups) {
    Get-ADGroupMember -Identity $Group -Recursive |
        Where-Object { $_.objectClass -eq 'user' } |
        ForEach-Object {
            Get-ADUser -Identity $_.SamAccountName -Properties PasswordLastSet, LastLogonDate, Enabled |
                Where-Object { $_.Enabled -and $_.PasswordLastSet -lt (Get-Date).AddDays(-$StaleThresholdDays) }
        }
}

$HighRisk | Select-Object SamAccountName, PasswordLastSet, LastLogonDate |
    Sort-Object SamAccountName -Unique | Export-Csv -Path $ReportPath -NoTypeInformation

Write-Host "[+] $($HighRisk.Count) privileged accounts with stale passwords exported to $ReportPath"

# 2. Force password change at next logon for flagged accounts (review CSV first)
# Uncomment after validation:
# Import-Csv $ReportPath | ForEach-Object {
#     Set-ADUser -Identity $_.SamAccountName -ChangePasswordAtLogon $true
#     Write-Host "[!] Forced password change: $($_.SamAccountName)"
# }

# 3. Audit Kerberos ticket lifetimes — reduce exposure window for stolen credentials
Get-ADObject -Filter 'ObjectClass -eq "domain"' -Properties maxTicketAge |
    Select-Object Name, maxTicketAge
# Recommended: reduce MaxTicketAge from default 10 hours to 4 hours for high-risk environments

# 4. Revoke active sessions for confirmed-compromised accounts (Entra ID — requires Microsoft.Graph)
# Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.Read.All"
# $CompromisedUsers = Import-Csv $ReportPath
# foreach ($u in $CompromisedUsers) {
#     Revoke-MgUserSignInSession -UserId "$($u.SamAccountName)@yourdomain.com"
# }