Vectra AI Detections

Vectra AI Detections is a network detection and response platform that uses AI algorithms and machine learning to identify threats based on behavioral analysis. The platform monitors network traffic and user behavior to detect anomalies indicating malicious activity across multiple attack surfaces including on-premises networks, Azure AD, M365, and AWS environments. The detection system categorizes threats by kill chain stages including reconnaissance, lateral movement, command and control, data exfiltration, privilege escalation, and botnet activity. It identifies specific attack patterns such as Kerberoasting, brute-force attempts, ransomware activity, privilege anomalies, suspicious port scans, and internal darknet scanning. For cloud environments, the platform detects AWS-specific threats including S3 enumeration, EC2 instance compromise, Lambda hijacking, privilege escalation, and suspicious credential access. In Azure AD and M365 environments, it identifies MFA disabling, suspicious device registration, internal spearphishing, mailbox manipulation, and unusual eDiscovery usage. The system provides detections for lateral movement activities such as automated replication, ICMP tunneling, SQL injection, shell knocker activity, and various privilege anomalies. It also monitors for command and control communications through DNS tunneling, hidden HTTP tunnels, and suspicious external connections. Vectra AI Detections operates continuously to identify both known and unknown threats by focusing on adversary behaviors rather than specific threat actor profiles.