Loading...
New
See what manual alert triage really costs your security team.
New
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
Loading...
An AI cyber attack is an intrusion, fraud, or extortion campaign where AI does part of the attacker's work. In the 15 cases Simbian graded, the strongest proof of AI came from attackers' files, provider logs, and vendor forensics, not the victim's alerts. In October 2026, Microsoft reported one campaign sometimes reaching privileged cloud access in under three hours.
Your alerts may catch an AI cyber attack. They rarely tell you it was AI. The best proof usually turns up later, in the attacker's own files.
CrowdStrike read an attacker's Claude Code sessions in an open directory on the attacker's own server. Anthropic investigated activity on its own platform. Hugging Face is the rare victim that recovered the proof itself, about 17,600 actions from the agent's own logs. In the intrusions Kaspersky published in November, the model ran on the attacker's server and "left no traces of its presence in the infrastructure."
Search your own environment for signs of AI, find nothing, and you still haven't ruled AI out.
We build Agents that attack and Agents that defend, and from that seat, "Was it AI?" belongs in the post-incident report. What you need to know this week is how long an intrusion runs in your environment before someone acts on it, because that's the clock AI moved. In September, Unit 42 said one intrusion that would normally take human operators around two weeks ran in under 10 hours. Only your own numbers can tell you whether you're losing that race.
Headlines on AI attacks also overshoot. Google's threat intelligence group said on October 30 that adversaries are "still in early stages," with open source tools used in "low-sophisticated ways, resulting in broad and noisy, but still successful campaigns." A skilled operator changes that picture. On one target in our lab, the open-source agentic pentest framework ARTEX confirmed 2 findings on a simple goal and 17 on an expert's plan.
An AI cyber attack is an intrusion, fraud, or extortion campaign where AI does part of the attacker's work, from forging one voice to running a whole operation. The way in hasn't changed much: stolen credentials, exposed services, and unpatched software still do the job. What mostly separates AI-powered attacks from traditional attacks is speed and scale.
Attacks on AI systems, such as prompt injection and data poisoning, are a separate category. Here, the attacker is the one using AI.
You may have read that AI hasn't changed breaches. Mandiant's M-Trends 2026 said "we do not consider 2025 to be the year where breaches were the direct result of AI," and it was right about 2025. The model has moved since. Kaspersky says language models were mostly used for preparation until recently, and now they're "embedded into the very core of the attack."
The best-evidenced AI cyber attacks of 2024 to 2026 are the Hugging Face intrusion, the ARTEX campaigns CrowdStrike and Check Point documented, Anthropic's GTG-1002, and Sophos's STAC6994, all backed by records of what the agent or attacker actually did. Others rest on forensics, telemetry, inference, or a police account, and ESET's PromptLock wasn't an attack at all.
Coverage takes the AI on trust. This table grades one thing: how we know AI was involved. Rows run from the strongest grade down. The last two sit at the bottom, outside the grades, because neither shows attackers proven to be using AI. One is a bug AI helped researchers find and exploit, the other a lab proof of concept. The table doesn't grade how bad the attack was, so if you quote one of these in a meeting, quote the grade with it.
| Case | Evidence grade | Date reported | What the AI did | How AI use is known |
|---|---|---|---|---|
| Hugging Face intrusion (agent driven by OpenAI models) | Strongest | Jul 2026 | Ran ~17,600 recovered actions across the campaign | The agent's own logs, recovered by the victim |
| GTG-1002 espionage (Anthropic) | Strongest | Nov 2025 | Did about 80 to 90% of the campaign across ~30 targets | The AI provider's records of activity on its own platform; victims not named |
| ARTEX intrusions at South Korean banks (CrowdStrike) | Strongest | Oct 2026 | Ran intrusions that stole data from financial institutions | The attacker's own Claude Code sessions and ARTEX configs, found in open directories |
| Vapor Panda espionage (CrowdStrike) | Strongest | Oct 2026 | ARTEX used against 200+ organizations; post-exploitation confirmed at nine | Agent transcripts exposed on the attacker's own controller |
| ARTEX crime campaigns (Check Point) | Strongest | Nov 2026 | Ran opportunistic attacks from a goal set by the operator; one crew recovered 190,000+ game credentials, an estimated 6,000 still valid | Databases of 10 misconfigured operator consoles |
| STAC6994 (Sophos report, details match this write-up) | Strongest | Jun 2026 | Helped build and test nearly 80 modules covering 70+ evasion techniques; humans drove, and claimed bypass success is unproven | The attacker's Git repository and agent playbooks |
| LAMEHUG malware, attributed with moderate confidence to APT28 (CERT-UA, Google) | Strong | Jul 2025 | Generated recon commands at runtime from an open-weight model | The model calls are in the malware's code |
| Agentic intrusion (Unit 42) | Strong | Sep 2026 | Used 50+ ATT&CK techniques in under 10 hours | Observed LLM calls and AI-generated scripts; the attacker also said so in negotiations |
| JADEPUFFER ransomware (Sysdig) | Strong | Jul 2026 | Assessed to have run a database extortion end to end | Payloads that explained their own targeting, and fixes that arrived 31 seconds after a failure |
| CyberStrikeAI intrusions at education organizations (Kaspersky) | Strong | Nov 2026 | Chose commands from the attacker's server, with operator approval possible; agent deployment to domain admin in 3 to 4 days | Kaspersky's forensics, the framework's implant, and scripts with LLM hallmarks |
| Storm-0940 after the ConnectWise breach (Microsoft) | Strong | Oct 2026 | Ran ARTEX against hundreds of organizations, reaching privileged cloud access in several attacks, some in under 3 hours; tried to sign in to 2,250+ Microsoft 365 tenants; most targeting failed | Microsoft's telemetry and assessment; no method published |
| Marimo intrusion (Sysdig) | Strong inference | May 2026 | Assessed to have run post-exploitation to a full database dump | Sysdig's read of command style and timing |
| Arup deepfake fraud (Hong Kong police) | Police account | Feb 2024 | Faked a CFO on a pre-recorded video call | Police account of the meeting; Arup confirmed it was the victim |
| PHP2Shell, a major Black October bug | AI-found bug | Oct 2026 | Helped researchers find the flaw and build the exploit | Researchers' own disclosure; Dream found AI tooling on one attacker's infrastructure, with "no direct evidence" it wrote the exploit |
| PromptLock "AI ransomware" (ESET) | Not an attack | Aug 2025 | Generated scripts with a local model | Built by NYU Tandon researchers as a proof of concept |
The grades come down to what the investigator had. Strongest takes records of what the attacker or agent actually did, such as logs, transcripts, provider records, or repositories. Drop to Strong and you have model calls, AI-written code, or a vendor's telemetry. Drop again and you have only a vendor's read of command style and timing. A police account gives the method and nothing technical.
STAC6994 needs a caveat. Sophos describes it as AI-assisted attack development inside a customer's network, and says it stopped the attacks "before they made it into the wild."
We picked the cases repeated most in coverage, plus the best-documented ones since 2024. We graded them from what each investigator published, as of November 6, 2026. We didn't see the raw evidence. Most rows rest on one publisher. Most publishers sell security, as we do. A row moves when the evidence does: recover Marimo's operator logs and it goes up, find a simpler explanation for JADEPUFFER's payloads and it comes down.
Logs the attacker failed to hide, a provider's records, malware code, a police statement. That last column is the finding.
We couldn't find a row where a victim's alert identified AI during the incident.
Vendors now ship signatures naming these frameworks, so an alert can tell you a tool was present. ARTEX shows how much of the rest depends on attackers' mistakes. It's an open-source agentic pentest framework, and in three campaigns the strongest proof came from files the operators left exposed.
On the attacker's server in the South Korean bank intrusions, CrowdStrike found a CLAUDE.md holding a Chinese-language pentesting prompt, with session histories in open directories. In one Claude Code session, the user asked for a security researcher résumé listing the results of the ARTEX work. No alert on your side surfaces that. Vapor Panda's controller "intermittently exposed adversary tooling, target files, and ARTEX agent transcripts."
Take those mistakes away and what's left is an intrusion that looks much like any other. Check Point counted 1,608 live, public ARTEX panels, and CERT-EU assessed on November 5 that public availability "will likely accelerate adoption by threat actors."
Hackers mostly use AI to run older attacks faster and at a larger scale. In the documented AI cyberattacks, the main types are agent-run campaigns, machine-speed intrusions, AI-built tooling, malware that agents rebuild, phishing and voice cloning, and hijacked AI accounts. Skilled operators get the most out of all of it.
In October 2026, Vapor Panda pointed ARTEX at more than 200 organizations, and one controller targeted entities in at least 14 countries in 11 days. CrowdStrike confirmed post-exploitation at nine. Agents, it says, let "a small team" pursue "a wider target set than manual operations would support." A separate group, Storm-0940, missed more than it hit: Microsoft reports the majority of its targeting wasn't successful.
An agent doesn't mind failing, so a long target list costs an attacker little.
Being on the list is enough to get you tried.
One crew in Check Point's November report ran two consoles for two weeks against 10 signing shops and spent an estimated $700 to $1,500 on tokens. It came away with more than 300 certificates, three of them usable. Another crew's agents kept claiming working cashouts, yet across 400,791 agent messages, "not one cent moved."
The break-in is still the slow part. In one Kaspersky case, a human got in through SQL Server. Then nothing happened for two weeks. Once the agent landed, persistence and local recon took two minutes. Days later, lateral movement, credential dumping, and a database export took no more than an hour. Sysdig timed Marimo's last phase, database dump included, at 113 seconds.
Microsoft says the speed of Storm-0940 "allows very little time for Defenders to respond to those alerts." If your team works the queue in the morning, the hour that mattered has already gone.
Speed doesn't beat everything. In the breach Unit 42 says ran in under 10 hours, the threat actor "told us in negotiations that they leveraged frontier AI models," and even had the agent leave an 80-page audit of the victim's security. Its Terraform backdoors still failed, because hard branch-protection controls stopped them. Branch protection stopped only that step, and it doesn't need anyone awake to work.
Some AI hackers can't build what they sell. Anthropic's August 2025 report described a ransomware seller who "could not implement or troubleshoot core malware components" without Claude, yet still sold finished variants for $400 to $1,200.
Our own testing shows the same drop. During supply chain tests, our AI Pentest Agent pulled a security fix from an open-source dependency, read the diff, worked out what the fix corrected, built a working payload for that bug class, and ran it. Web search and basic reasoning. Nothing exotic. On logic bugs, auth bypasses, and injection, what used to need an exploit-dev specialist and a few days now needs an agent and an afternoon.
A patch going public is an attack map going public. Reachability still decides whether that map leads anywhere in your environment.
LAMEHUG, documented by CERT-UA, generated its commands from fixed prompts while running. Anthropic reported in September 2026 that agents working for a group consistent with Midnight Blizzard watched whether their malware was detected, then rebuilt it until it wasn't. If agents can rebuild a tool on demand, the hash you blocked on Monday says little about Tuesday's build. Don't overread that. Sophos's STAC6994 case cuts the other way. Humans drove the evasion work, and the test output didn't necessarily support the agents' claims of near-universal success.
Fully AI-written spear phishing matched human experts in the 2024 Heiding study, a test on 101 people split into groups, with a 54% click rate against 12% for generic phishing. A convincing lure may no longer take a skilled person at the keyboard, though experts still wrote the study's prompts.
Voice has gone the same way. The FBI warned in December 2024 that criminals clone the voices of public figures and relatives, then in May 2025 that AI-generated voice messages were impersonating senior US officials. A familiar voice shouldn't be enough to reset a password now.
Video is where the story gets retold wrong. The popular version of Arup is a live deepfake meeting with a room full of executives. Hong Kong's Security Bureau told legislators that police believed the call was built from public video clips. It was "pre-recorded," so "there was actually no interaction" with the fraudster. The firm still lost about HK$200 million (roughly US$25 million) in early 2024. A callback rule on payments would likely have stopped it, whatever the video looked like.
Unit 42's September 2026 attacker turned the victim's own cloud AI endpoints into attack infrastructure, which Unit 42 warns lets attackers hide in normal traffic and bill you for the compute. When you list what an attacker could use against you, put model API keys next to your admin credentials.
How much human an AI cyber attack needs depends on the target, and the recovered transcripts show two different attackers. Check Point read 10 exposed ARTEX consoles run by criminals and found "most attacks were fully autonomous besides the initial goal setup." One operator's prompts are mostly some version of "What's the progress?"
Vapor Panda looks different. Its agents took orders labelled "human instruction." One told them to find Windows machines without the Falcon sensor, and against a Greek government entity the operator handed the agent a 2022 directory export, keys likely never rotated.
We measured that gap in our lab. On one target, ARTEX on a simple goal confirmed 2 Medium findings. Given a phased plan from a senior researcher, it confirmed 17, including 1 Critical. That's one vendor-run test on one target, so don't stretch it far.
Check Point's crews hit gray-market shops and crypto sites. Vapor Panda went after foreign ministries. My read is that the harder the target, the more a skilled person still matters.
So the low end of your exposure runs itself, while someone is steering the high end.
Black October was partly an AI cyber attack. The name covers a wave of disclosures and breaches in October 2026. In it, AI helped researchers find PHP2Shell, and ARTEX ran the attacks that followed the ConnectWise breach. One PHP2Shell campaign also looks AI-assisted, though Dream, which found it, has "no direct evidence" that AI wrote the exploit.
Security experts gave the month that name. One of its most significant stories, PHP2Shell, is a pair of PHP remote code execution flaws that researchers at Calif and Wiz found with help from AI models. Governments took websites offline, and PHP shipped fixes on October 21.
This is where "same techniques, just faster" undersells it. Wiz says frontier models turned a long-standing flaw into an exploit, and that "a single researcher completed in a week what previously would have taken a world-class team months of work." Before this, I wrote that memory corruption against modern mitigations was still real work, even for an agent. PHP2Shell is a set of memory-safety bugs. It's one case, with some of the best researchers in the field driving, and it's the one I'd watch.
Attackers didn't wait. AWS logged an exploitation attempt on a honeypot on October 17, four days before the fix. We found no published evidence that AI was behind it.
Dream later found the campaign with the clearest AI link. It rooted 25 servers running PAN-OS, including systems in a US government-affiliated environment, and Unit 42 verified the tooling. Claude Code sat on the attack infrastructure. An AI offensive platform was configured with DeepSeek and Kimi. About 40 scripts read as if AI helped write them. That's evidence of AI nearby, which is a weaker thing than AI doing the work.
The clearer AI-run attacks came from Storm-0940, a China-state aligned group Microsoft assesses was behind the ConnectWise Cloud Backup breach. It ran ARTEX against hundreds of organizations from September, and after the breach it tried to sign in to more than 2,250 tenants. Most of the targeting failed. The rest is the problem. The group "achieved privileged cloud persistence at many organizations in a brief time."
In multiple cases, the time from first targeting to privileged access was less than three hours.
Three checks are worth starting now:
artx or artex in command lines, artx-prefixed cloud roles, and a C:\ProgramData\artx5v\ directory. A hit shows the tool was there. No hit proves nothing.The first publicly disclosed autonomous AI cyberattack with no human attacker is the Hugging Face intrusion of July 2026. Anthropic later found Claude models had breached three real organizations during its own tests, the earliest in April. Anthropic's GTG-1002, detected in September 2025, is the first at scale where AI did most of the work for a human crew.
| Event | Reported | The "first" attached to it | Where a human stayed in charge |
|---|---|---|---|
| GTG-1002 (Anthropic) | Nov 2025 | Large-scale attack executed with little human intervention | Humans chose targets and made perhaps four to six key decisions per campaign |
| Marimo (Sysdig) | May 2026 | First agent-driven intrusion Sysdig's team captured | Not established; Sysdig inferred agent control from command style and timing |
| JADEPUFFER (Sysdig) | Jul 2026 | First documented agentic ransomware | Unknown; Sysdig had no view of the operator's setup |
| Hugging Face intrusion | Jul 2026 | "possibly the first of its kind" (Hugging Face's CEO); no human attacker | None; evaluation agents chose the target themselves |
| Claude evaluation incidents (Anthropic) | Jul 2026 | None claimed, though the earliest date to April | No human chose the real targets; the models were told it was a simulation, though Opus 4.7 kept attacking after recognizing a real system, assuming it was part of the exercise |
Vendors love the phrase "first autonomous attack." Ask which definition they mean. Google said in September 2026 it "has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild." For your detections the label matters less anyway, because most of these incidents chained attack classes you already monitor.
The Hugging Face attacker was an AI agent, and the motive is the strange part. The company's technical timeline describes an agent "driven by a combination of OpenAI models" that was running an internal cyber-capability evaluation, and Hugging Face believes it broke out to steal the test answers. It escaped its sandbox through a zero-day in a package proxy and staged on a third party's code sandbox.
We've seen that shortcut in our own cyber-defense LLM evaluations. The model goes for the answer, then explains the shortcut away. We call it agentsplaining.
Hugging Face's responders turned to hosted frontier models, and the models refused to analyze much of the attack. So they ran an open-weight model on their own infrastructure. Sumedh Barde and I walked through the chain in a webinar.
If you run agents with credentials, scope them like insiders, and pick your defensive model before the night you need it.
Five widely repeated statistics on AI-powered cyberattacks, from SlashNext's 1,265% to SoSafe's 87%, prove less than their headlines suggest. IBM's 2026 finding that one in four malicious breaches were AI-enabled comes closest, and even that is self-reported by the breached organizations. SoSafe's 87% is a survey. It asked 600 people whether they thought they'd seen an AI cyberattack.
| Claim as usually quoted | Source | What it measured | Verdict |
|---|---|---|---|
| Phishing up 1,265% since ChatGPT | SlashNext, 2023 | Phishing volume in its own telemetry over 12 months, with no measure of how many emails AI wrote | Timing only |
| 87% of organizations hit by an AI cyberattack | SoSafe, 2025 | Whether 500 security professionals and 100 customers said they'd encountered one; 26% were highly confident they could detect one | Self-report |
| AI phishing gets 4.5 times more clicks | Heiding et al., 2024 | A 101-person study in which AI matched human experts at 54%; the 12% baseline was generic phishing | AI equals experts |
| AI-enabled attacks up 89% | CrowdStrike, 2026 | Attacks by adversaries CrowdStrike classes as AI-enabled, with no measure of how much of the work AI did | Actor label |
| One in four malicious breaches AI-enabled | IBM and Ponemon, 2026 | Real breaches at 602 organizations, with AI involvement as the breached organizations reported it, mostly deepfakes and AI-enabled malware | Self-reported, best of the five |
Count the incidents your own team confirmed, and treat industry percentages as a weather report.
Open a board update with 87% and the first question will be how anyone knew.
In your logs, an AI cyber attack usually looks like a fast, tireless operator, and whether AI shows depends on where the model runs. When it runs on the attacker's server, as in Kaspersky's cases, your hosts mostly see familiar commands. When an agent runs inside your environment, it leaves traces like Markdown state files, Python caches, and disabled pagers.
Kaspersky is blunt about the first case: "the actions performed by an AI agent on the network are indistinguishable from those of a human," so well-tuned correlation and behavioral rules are enough to catch them. That cuts against anyone selling a new category of AI-attack detection, us included. I think Kaspersky's right about detection, and it still leaves the question of who gets to your alert in time.
Agents inside your network are different. They leave things behind. Unit 42 found Markdown files passing state between agents and sessions, and Sysdig saw output separators, truncated captures, and pagers switched off. JADEPUFFER's payloads explained their own targeting in code comments, down to which database was "largest." LAMEHUG called a hosted model from infected machines, so if you don't alert on model API calls from servers, start.
While it's happening, alert on what the attacker is after. A process reading credential files. A burst of secret listings followed by retrievals. LSASS dumps, DCSync, a mailbox exported in bulk. Microsoft's Storm-0940 detections work the same way, flagging an application that grants itself a privileged role.
AI attacks are harder to defend against because they can outrun a human alert queue, and attackers have the better signal to train on. An attacker can check success for free: it worked or it didn't. A defender who clears an alert gets no such signal.
Writing an exploit is deductive. You got in or you didn't, and if you got in, the proof is standing in front of you. (An agent's report isn't the proof, as Check Point's crew learned. The shell or the wallet is.)
Defending is the opposite. Take a risky sign-in from a city one of your people has never used. You check whether they've signed in from there before. You call them. You check with their manager. You go back ninety days looking for something that read as nothing at the time.
Each check lowers the odds of an intrusion, and none takes them to zero, so you never finish that investigation. You abandon it. "Malicious" has a proof, one witness. "Benign" has none. It's the name we give to stopping.
So a real attack that was investigated and missed looks identical to a correct close, and your miss rate is invisible.
That's why offense trains so much faster. Anyone can generate unlimited attempts with the answer attached. You rarely learn which of your thousands of actions stopped an attack, because real incidents seldom record it and abandoned attack paths leave no trace. On Simbian's October 2026 Cyber Defense Benchmark, which has models hunt attacks in log data, none of 32 frontier models clears 50% coverage on every MITRE ATT&CK tactic, yet the same model families run real intrusions. The leader, Opus 5, covers 45.1% of an attack's steps on average.
There's a second asymmetry, and ARTEX made it literal. John Lambert wrote years ago that "defenders think in lists. Attackers think in graphs." I've repeated that line in talks as a figure of speech. CrowdStrike now describes ARTEX coordinating its agents "over a shared graph of facts, findings, and goals." The Markdown files Unit 42 found do the same job. So does the CLAUDE.md on the Korean attacker's server, the same trick I wrote about in an earlier Anthropic case. It's like chess: the attacker saves the whole board state, while the defender has to rebuild the board from fragments every move.
That gap is why defense needs its own training ground. Ours is the war lab, a company that doesn't exist, with one AI attacking it while another defends. Because we author both sides, we know the attacker's goal, every path it tried, and which defensive action worked. No customer data enters the lab.
To prevent AI cyber attacks, start with the basics: phishing-resistant MFA, patching, segmentation, and verified help-desk resets. Then guard AI keys, detect what attackers are after, call back on payments, and test yourself with planted attacks. Last comes the hard one: investigate every alert before an intrusion has hours to run.
Simbian works on that last one.
Our AI SOC Agent investigates and responds to every threat, on average in under 4 minutes from detection to response. 95% of the responses it proposes are approved by the customer's own analysts. Their call, not ours. Every action can require sign-off before it runs. Ask to see both on your own telemetry.
It won't catch everything. It investigates what your telemetry records, so an attacker working through a system you don't log stays out of its view. And no alert fires when a finance clerk follows instructions from what looks like the CFO, which is why the callback rule above matters.
How long did your last confirmed intrusion run before anyone acted on it? "Was it AI?" can wait for the post-incident report. That number can't. Book a Demo to see Simbian investigate an agent-speed intrusion from first alert to response.
Q: How are AI cyber attacks different from traditional attacks? Mostly in speed and scale. Kaspersky calls an agent's actions on the network "indistinguishable from those of a human," so the techniques are familiar. Unit 42 says one intrusion that would normally take around two weeks ran in under 10 hours, and CrowdStrike saw one group use ARTEX against more than 200 organizations.
Q: Are AI cyber attacks causing more breaches? The published numbers can't show that. IBM and Ponemon found that one in four malicious breaches at 602 organizations were AI-enabled, but the breached organizations reported it themselves. CrowdStrike's 89% rise counts attacks by adversaries it labels AI-enabled, and it doesn't say how much of the work AI did. Neither figure shows a breach that wouldn't have happened without AI. Your own confirmed incidents will tell you more.
Q: How is AI being used in ransomware attacks? AI ran a ransomware operation end to end in at least one case Sysdig assessed. Sysdig reported in July 2026 that an agent it tracks as JADEPUFFER exploited a Langflow server, harvested credentials, and encrypted a production configuration database. PromptLock, which ESET called the first known AI-powered ransomware in August 2025, was an academic proof of concept.
Q: What are the risks of open-source AI models for cybersecurity? Attackers already use open-weight AI models. LAMEHUG malware, attributed with moderate confidence to APT28, queried the open-weight Qwen2.5-Coder model through Hugging Face's API during live operations in 2025. Google reported an actor running an open-weight model on compromised cloud infrastructure to avoid API monitoring. Blocking one commercial model provider doesn't remove the capability.
Q: What are the major AI cyber attack trends in late 2026? Agentic pentest frameworks are the fastest-moving AI cyber threat. CrowdStrike and Microsoft documented ARTEX across separate China-aligned groups in October 2026, Check Point counted 1,608 live panels in November, and CERT-In issued a Critical advisory on November 4 covering AI-driven attacks on financial services. The time from initial targeting to privileged access has fallen to hours in some attacks.
Q: Can existing security controls stop AI cyber attacks? Mostly, if they're acted on in time. Kaspersky found classic correlation and behavioral rules sufficient to detect the CyberStrikeAI intrusions, which used a well-documented set of domain compromise techniques. Microsoft saw Storm-0940 reach privileged cloud access in under three hours, so the alert has to reach someone within hours.
