Agentic Attack Pattern - Automated Multi-Stage Intrusion Lifecycle

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).