Posture check · Cross-tier exposure
Cross-tier credential exposure (T1003, T1078)
A Tier 0 credential was seen on a computer where a lower-tier account holds rights that can steal it. Other tier pairs are not yet assessed, and computers in a domain with no logon collection aren't checked.
Why it matters
A logon leaves credential material on the computer. Anyone who administers that computer can take it and act as the Tier 0 account.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Active Directory and Microsoft Entra ID.
It reads:
- The privilege tier classification
- Logon sessions seen in telemetry from your domain controllers
Tiered Fidelity™ level: Validated
Every finding from this check carries the Validated level.
- TheoreticalConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedThis checkTelemetry has seen it in use.
Why there's no automatic fix
The holder's rights on this computer come from group policy or local user rights, which GraphnAI doesn't change.
How to fix it
Remove the lower-tier account's rights on this computer. Rotate the Tier 0 credential too, since it may already be copied.
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.