Best Detection of 2026 Series: Rapid Valid-Account Privilege Escalation After Initial Access Broker Handoff
Detects a suspicious pattern consistent with rapid handoff from an initial access broker to an operator: a user account is added to a privileged group (e.g., Domain Admins) followed within 5 minutes by successful logins to 3 or more distinct hosts. This behavior indicates immediate privilege escalation followed by rapid lateral movement.
CQL
