AI Orchestration Service Account Remote Authentication (Lateral Movement)
Detects successful remote authentication events (Network or Interactive) performed by AI agent orchestration service accounts. This rule monitors for atypical lateral movement patterns where an automated service account pivots to remote hosts using protocols such as RDP or WinRM, diverging from its standard operational context.
Sigma
