Avanpost SmartPAM Adds 60 MITRE ATT&CK Signatures for Privileged Session Threat Detection

Avanpost has expanded its SmartPAM solution with a new library of 60 signatures aligned to the MITRE ATT&CK matrix. The update, available in version 1.4, enables the Privileged Access Management platform to inspect activities inside privileged sessions instead of limiting itself to access control at the entry point.

The signatures address key stages of attacker behavior after initial compromise, including credential access, persistence mechanisms, lateral movement, and defense evasion techniques. Specific examples include attempts to disable operating system auditing, antivirus software, or firewalls, as well as clearing system logs or obfuscating executed commands.

Session data is processed by an integrated signature analysis engine that normalizes events, correlates them with known attack patterns, and initiates predefined responses. Available actions include blocking individual commands, terminating user sessions, or forwarding alerts to a SIEM platform.

Organizations can extend the supplied rule set with their own custom signatures and tailor detection policies to the specifics of their infrastructure and security requirements. The signature library is distributed via subscription, with free access guaranteed by Avanpost through the end of 2026 and regular updates promised thereafter.

According to the vendor, SmartPAM is the first PAM product to deliver a detection library structured according to the MITRE ATT&CK framework. The enhancement transforms the solution from a simple gateway for privileged accounts into a continuous monitoring system that evaluates every action performed after authentication, addressing the reality that stolen or misused administrator credentials often appear legitimate to basic access controls.