GTG-1002: Modeling Agentic AI Cyber Espionage Operations and What Detection Looks Like

Speed without proportional scale. A human-operated APT campaign with a 5-person team can run reconnaissance on 10-20 targets in parallel. An agentic AI system with the same capability profile can run reconnaissance on thousands of targets simultaneously, adapting the approach for each target based on what it discovers. This changes the signal-to-noise ratio: at human pace, targeted reconnaissance against your organization produces a small number of detectable events. At AI pace, the same reconnaissance is embedded in a global campaign and your organization's events look like noise within a larger pattern.

Real-time tactic adaptation without human review. Human APT operators pause between phases: they exfiltrate reconnaissance data, review it, choose the next step, build the payload, and then execute. Each pause creates a detection opportunity. An agentic AI system executes the same loop in milliseconds: observe environment, evaluate options, select action, execute, observe results. There is no human review pause between reconnaissance and exploitation, eliminating the temporal gap that most kill-chain-based detection logic relies on.

Credential and identity access as the primary vector. Agentic AI systems are particularly effective at identity-based attacks because LLMs can generate convincing context-aware social engineering at scale and can autonomously manipulate OAuth flows, MFA bypass workflows, and password reset mechanisms. The helpdesk impersonation attack that required a skilled social engineer to execute manually becomes a fully automated workflow an AI agent can run against thousands of accounts per hour.

Tool reuse from legitimate platforms. Unlike traditional malware that requires custom tooling, agentic AI systems can use the same APIs and automation platforms that legitimate DevOps and IT operations use: GitHub Actions, AWS Lambda, Azure Automation, Zapier. The attack tooling is functionally identical to legitimate operations tooling, making behavioral detection harder.

Phase 1: AI-Assisted Reconnaissance

Observable signals:

• High-volume LinkedIn/GitHub profile scraping from unusual ASNs or VPS ranges
• Automated DNS enumeration patterns (sequential subdomain probing at machine pace)
• Burst-pattern OSINT queries against company data APIs (Crunchbase, LinkedIn API, GitHub API) at rates that exceed human browsing
• Job posting scraping to identify technology stack from job descriptions

ATT&CK technique: T1591 (Gather Victim Org Information)

Phase 2: LLM-Generated Spear Phishing

Observable signals:

• Phishing emails with personalized organizational context (references to specific projects, recent LinkedIn activity, specific colleagues) that exceed the personalization level of commodity phishing
• High volume of similar-but-distinct phishing emails sent in a short window (one campaign producing 1,000 individually personalized emails in 10 minutes)
• Phishing domain registration patterns (domain registered within 24 hours of target's major public event)

ATT&CK technique: T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link)

Phase 3: Automated Credential Access

Observable signals:

• MFA fatigue attacks at machine pace (50-200 push notifications per minute rather than the 10-20 typical of human-operated fatigue attacks)
• Automated helpdesk ticket creation requesting MFA bypass with AI-generated justification
• Password spray across hundreds of accounts within a single minute
• OAuth authorization flows initiated from unexpected locations with machine-paced consent click timing

Phase 4: Autonomous Lateral Movement

Observable signals:

• API calls that traverse multiple services in sequence at sub-second intervals (a human navigating between Azure portal, Entra, and Exchange typically takes 5-15 seconds between each action; an AI agent operates at milliseconds)
• Systematic enumeration of all accessible resources immediately after credential compromise, rather than targeted navigation to known resources
• File access patterns that follow a logical discovery order (enumerate then access, then exfiltrate) in a compressed time window

Phase 5: AI-Optimized Data Exfiltration

Observable signals:

• Exfiltration through legitimate cloud services (Dropbox API, SharePoint, GitHub) rather than unusual outbound endpoints
• Exfiltration volume that is suspiciously optimized (compressed, deduplicated, targeted at high-value file types) compared to bulk data staging typical of human-operated exfiltration
• Exfiltration occurring within the same session as credential compromise, without the multi-day staging delay typical of human APT campaigns

Current SIEM detection rules tuned for human-pace adversaries will miss many agentic AI signals because the temporal thresholds are wrong. Human-paced brute force: 100 failed logins over 60 minutes. AI-paced brute force: 100 failed logins in 60 seconds. The detection logic is correct but the time window needs to be an order of magnitude tighter.

Detection 1: Sub-second API call sequencing after credential event

(EventCode=4624 OR EventCode=4625) 
| join user [
  search EventCode=4624 
  | stats count, min(_time) as first_success by user 
  | where count > 0
] 
| streamstats window=10 current=true list(_time) as times by user 
| where mvcount(times) > 1 AND
  abs(mvindex(times,0) - mvindex(times,1)) < 1
| alert severity=high

This detects authentication events where the interval between consecutive events for the same user is under 1 second -- a timing pattern impossible for a human but characteristic of an AI agent.

Detection 2: Enumeration burst immediately following authentication

For Azure/Entra environments, flag a user account that authenticates and then queries more than 20 unique Microsoft Graph API endpoints within 60 seconds:

AuditLogs
| where TimeGenerated > ago(1h)
| where OperationName contains "List" or OperationName contains "Get"
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(1h)
    | project AccountName=UserPrincipalName, SigninTime=TimeGenerated
) on AccountName
| where TimeGenerated - SigninTime < 60s
| summarize EndpointCount=dcount(OperationName) by AccountName, SigninTime
| where EndpointCount > 20

Detection 3: MFA push velocity exceeding human limit

MFA push notifications at rates above 15 per minute are physically impossible to approve or deny manually at that pace:

source=okta EventType=system.push.send_factor_verify_push
| bin _time span=1m
| stats count by _time, user
| where count > 15
| alert severity=critical

Missing: Cross-platform timing correlation. An AI agent that authenticates to Azure AD, waits 30 minutes (to avoid velocity-based triggers), accesses SharePoint, waits 30 minutes, and exfiltrates via OneDrive will not be caught by per-platform velocity detections. Each individual platform sees normal-pace activity. Only a cross-platform correlation that links the authentication event, the resource access, and the exfiltration event across platforms reveals the compressed logical kill chain.

Missing: Content-based lure detection. Current phishing detection is primarily domain-reputation-based (new domain + lookalike + suspicious link pattern). LLM-generated spear phishing bypasses reputation-based detection because the domains may be legitimate (attacker-controlled but aged), and the content is indistinguishable from legitimate email. Content-based detection that scores the specificity of organizational context in inbound email is not standard in most email security gateways.

Missing: AI timing signature analysis. The millisecond-level timing of API call sequences is captured in audit logs but rarely analyzed. Human behavior has a characteristic cadence (pauses between actions, natural variation in inter-event timing). AI agent behavior has a different cadence (consistent sub-millisecond scheduling, no pause-for-thought variation). Timing signature analysis that identifies the AI cadence in API log sequences is a capability that is currently research-stage rather than production-deployed in most SIEMs.

Missing: Legitimate tool abuse detection. When an attacker uses GitHub Actions, AWS Lambda, or Azure Automation as the exfiltration mechanism, the outbound traffic looks identical to legitimate DevOps operations. Detecting this requires behavioral baseline of what legitimate DevOps tooling does and alerting on deviations -- the specific data types, destinations, and volumes that are anomalous for the organization's DevOps profile.

For threat hunters building GTG-1002-specific detection hypotheses:

Hypothesis 1: AI agent pivot via OAuth. Hunt for OAuth authorization grants that were created by a non-browser application and that have broad scopes (Mail.ReadWrite, Files.ReadWrite.All). An AI agent that compromises an account and immediately grants an OAuth application broad access is creating a persistent foothold that survives password resets.

Hypothesis 2: Automated discovery after credential compromise. For every Entra ID account that had a suspicious authentication (from new location, new device, or after password reset), hunt for Graph API calls within the first 60 seconds that enumerate users, groups, applications, and service principals. This enumeration pattern is characteristic of an AI agent mapping the environment immediately after gaining access.

Hypothesis 3: LLM-generated phishing with organizational specificity. Build a scoring model that flags inbound emails containing: specific colleague names and departments, references to internal projects or recent public events, and an urgency/action request. Score by specificity and flag emails that are too specifically contextual to be commodity phishing without being part of a known legitimate communication thread.

For SOC teams building detection coverage maps for agentic AI espionage:

MITRE ATT&CK techniques most exploited by agentic AI operations:

• T1078: Valid Accounts (agentic AI specializes in credential compromise and account takeover)
• T1621: Multi-Factor Authentication Request Generation (MFA fatigue at AI pace)
• T1534: Internal Spearphishing (after account compromise, AI agent sends phishing from the compromised account to internal contacts)
• T1119: Automated Collection (systematic file enumeration and staging without human curation)
• T1048: Exfiltration Over Alternative Protocol (exfiltration via legitimate cloud APIs)

MITRE ATLAS techniques specific to AI-operated campaigns:

• AML.T0040: ML Attack Staging (use of AI models to plan and execute attack campaigns)
• AML.T0043: Craft Adversarial Data (LLM-generated phishing content)
• AML.T0000: ML Model Access (targeting of AI systems themselves as espionage targets)

For detection rules mapped to these techniques, the MITRE ATT&CK Navigator can be exported as a coverage layer to identify which SIEM rules cover each technique. Agentic AI-specific detections are most sparse at T1078 (automated credential reuse across services) and T1534 (AI-drafted internal spearphishing).