Identity and Access

A valid password looks like a valid sign-in. An attacker holding one breaks nothing. They open the doors the account owner opens, and every step is logged as ordinary work. The record of the attack already exists. What is missing is a way to tell the owner's behavior from the attacker's.

Accounts

MITRE ATT&CK lists the misuse of valid accounts as technique T1078. Its detection guidance points to anomalous logon patterns: unusual times, unusual hosts, interactive logons from service accounts and concurrent sessions. The attack unfolds in four steps, and each one is an allowed sign-in.

Stolen credentials

Nothing about the password is wrong. The only difference is the hour, the host or the neighbor the account reaches.

Lateral movement

One sign-in proves little. A logon on one host, then another within a set window, is the pattern that matters. A relationship graph shows an account reaching hosts it never touched before.

Privileged accounts

Administrator accounts are worth the most to an attacker, and their behavior is the first to change. A rising risk score on the timeline shows which accounts to look at first.

Service accounts

Service accounts run the same job at the same time every day. A new destination or a new sequence of actions is the signal.

Collection

Detection starts with the records your directory already produces. No agent has to run on the domain controller.

ARRTECH SIEM collects Active Directory, LDAP, VPN, Windows Event Log, Microsoft 365 and Azure records by agent, syslog, WMI and more, and syncs assets from LDAP. Every log is hashed and signed, and the signature chain is timestamped daily, so the evidence behind a finding holds up later.

Correlation rules link sequences across sources within a set window and map each step to MITRE ATT&CK. Every user and entity carries a dynamic risk score on a timeline, so risk is visible before anyone opens a case.

Detection

A rule describes an attack someone has already seen. A misused account is only unusual against its own history.

Cyberdroid AI Detection, the AI layer of the ARRTECH Security Suite, baselines every user, host and application against its own history and its neighbors across identity, network, DNS, process and firewall telemetry. It reads the SIEM export from a read-only share and runs near-hourly.

Every finding carries the observed value beside the baseline, the score, the threshold and an ordered evidence timeline. You see the evidence and decide.

Silence

A missing log is a finding too. ARRTECH SIEM alerts when a source goes silent and correlates on the absence of an expected event. AI Detection reports telemetry health beside every result, so you can tell nothing found from nothing seen.

Response

Resetting a password or disabling an account is a decision about a person, and it belongs to people. AI Detection changes nothing in your directory. A person reviews the evidence and approves. ARRTECH SOAR runs the playbook, and the execution history keeps every step.

Limits

What these products do not do with identity.

Access

ARRTECH SIEM and Cyberdroid AI Detection do not issue identities or manage access. They read what your directory already records.

Timing

AI Detection runs near-hourly, so activity from one hour is eligible for analysis shortly after that hour ends. SIEM correlation rules run at set intervals and alert by email or SMS.

Action

AI Detection never resets a password, disables an account or blocks a session. A score is a prioritization aid, not a verdict, and a graph relationship does not prove intent.

Evaluation

A proof of value runs on labelled replay scenarios and one business week of your own sign-in records, with the scorecard agreed before it begins. You see which accounts the baselines flagged, the evidence each finding carried, precision and false positives, how missing feeds were handled, and the CPU, memory and storage it used.

Proof of value