Black Hat Asia 2026 | Graph-Aware LLM for Windows Logon with a Closed-Loop Guarded Detection Agent
Source: YouTube · Black Hat · published Aug 27, 2026 · 40:31
[BLUF]
This presentation introduces an AI-driven framework for detecting compromised Windows accounts at enterprise scale by compressing massive log volumes into authentication graphs and using an evidence-based AI agent for investigation 1:54. The system achieves high detection accuracy and reproducibility by prioritizing structural features over raw log consumption 25:17.
Key Takeaways:
• Problem Context: Real-world attacks often mimic normal logon activity, making detection difficult due to the overwhelming volume of Windows event logs 0:14. Standard signature-based detection is insufficient for identifying sophisticated lateral movement or credential abuse 2:24.
• Graph-Based Compression: The system converts raw logs into a user-host authentication graph, reducing data size by ~50x (e.g., 50 MB to 1 MB) while preserving critical relationship structures 10:26. This compression is essential to bypass LLM context limits and reduce costs 11:11.
• Feature Engineering: To guide the AI, the system computes features like PageRank (to identify central accounts) and Hidden Markov Models (to detect anomalous login sequences) 14:00. These features help the agent prioritize suspicious accounts, such as those exhibiting "fanout" patterns typical of lateral movement 14:48.
• AI Agent Workflow: A constrained AI agent performs a closed-loop investigation by generating targeted database queries, analyzing results, and building evidence-based conclusions 18:13. Strict "guide rails" ensure the agent only produces structured JSON outputs supported by concrete log evidence 20:55.
• Evaluation & Case Study: The system demonstrated 0.9 precision and 0.97 recall against rule-based detection, with high reproducibility (Jaccard index 0.836) 26:10. In a real incident case, it analyzed 869 MB of logs in under 3 minutes, identifying lateral movement via privileged account abuse 29:30.
• Prevention via AI: Beyond detection, the framework uses AI to automatically draft Sigma detection rules based on confirmed malicious patterns, turning incident response into proactive prevention 35:57.
Closing Statement:
By combining graph compression with constrained AI reasoning, this approach offers a scalable method to cut through log noise and identify compromised accounts efficiently. The framework is open-source and designed to assist, rather than replace, human analysts in the investigation process.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Incident Response. Commonly maps to: Security Operations, Security Assessment and Testing. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Thank you for coming to my session. Today's topic is Windows logon. Many real attacks just just look like normal logon in the logs. That's why incident response often starts with confusion. In this talk, I will share practical ways cut through Thank you. In this talk, I will share a practical way to cut through that noise. Attacker often have a misestimate authentication. They use a stored password, ticket, or hash. However, they still log into normal Windows pass. As a result, their logs often do not looks obviously malicious. Many enter looks just like a routine administrative activities. This makes the detection and the total discard. For blue teams, the problem is not a lack of logs. The pro- real problem is having too many logs and a too little signal. Windows event log are not design…