[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFWBXFPRR9FX2M15EEV32W":3,"skill-same:01M6AFWBXFPRR9FX2M15EEV32W":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":76,"repositoryHtmlUrl":77,"repositoryHomepageUrl":78,"ownerHtmlUrl":79,"ownerBlogUrl":80,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6AFWBXFPRR9FX2M15EEV32W","performing-lateral-movement-detection",null,"Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading by correlating Windows Security\u002FSysmon event logs, network flow data (NetFlow\u002FZeek), and endpoint telemetry in a SIEM, mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques with sample SPL detection queries. Use when a SOC team needs to detect attackers pivoting between internal systems after initial compromise, trace an attacker's movement path during an incident investigation, or build detection engineering rules for TA0008; not for detecting initial access or external attacks.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-detection\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing lateral movement detection","detection","lateral-movement","analysis","t1566","t1078","rdp","smb","ta0008","pass-the-hash","cybersecurity","sysmon","netflow","data","flow","network","soc","mitre-attack","logs","siem","2026-11-10 10:12:30",false,"---\nname: performing-lateral-movement-detection\ndescription: 'Detects lateral movement techniques including Pass-the-Hash, PsExec,\n  WMI execution, RDP pivoting, and SMB-based spreading by correlating Windows Security\u002FSysmon\n  event logs, network flow data (NetFlow\u002FZeek), and endpoint telemetry in a SIEM,\n  mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques with sample SPL detection\n  queries. Use when a SOC team needs to detect attackers pivoting between internal\n  systems after initial compromise, trace an attacker''s movement path during an\n  incident investigation, or build detection engineering rules for TA0008; not for\n  detecting initial access or external attacks.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- lateral-movement\n- mitre-attack\n- pass-the-hash\n- psexec\n- wmi\n- rdp\n- smb\n- detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Token Binding\n- Execution Isolation\n- Restore Access\n- Application Protocol Command Analysis\n- Process Termination\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n- T1021\n---\n# Performing Lateral Movement Detection\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to detect attackers pivoting between systems after initial compromise\n- Incident investigations require tracking an attacker's movement path through the network\n- Detection engineering needs lateral movement rules mapped to ATT&CK TA0008 techniques\n- Red\u002Fpurple team exercises identify lateral movement detection gaps\n\n**Do not use** for detecting initial access or external attacks — lateral movement detection focuses on internal host-to-host pivot activity.\n\n## Prerequisites\n\n- Windows Security Event Logs (EventCode 4624, 4625, 4648, 4672) from all endpoints and servers\n- Sysmon deployed with process creation (EventCode 1), network connections (EventCode 3), and named pipe (EventCode 17\u002F18)\n- Network flow data (NetFlow\u002FsFlow, Zeek connection logs) for internal traffic analysis\n- SIEM with cross-source correlation capability\n- Baseline of normal internal authentication patterns\n\n## Workflow\n\n### Step 1: Detect Pass-the-Hash \u002F Pass-the-Ticket (T1550)\n\n**Pass-the-Hash Detection (EventCode 4624 with NTLM):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=3\nAuthenticationPackageName=\"NTLM\"\n| where TargetUserName!=\"ANONYMOUS LOGON\" AND TargetUserName!=\"$\"\n| stats count, dc(ComputerName) AS unique_targets, values(ComputerName) AS targets\n  by src_ip, TargetUserName\n| where unique_targets > 3\n| eval alert = \"Possible Pass-the-Hash: NTLM network logon to \".unique_targets.\" hosts\"\n| sort - unique_targets\n| table src_ip, TargetUserName, unique_targets, count, targets, alert\n```\n\n**Overpass-the-Hash Detection (Kerberos with RC4):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4769\nTicketEncryptionType=\"0x17\"\n| where ServiceName!=\"krbtgt\" AND ServiceName!=\"$\"\n| stats count, dc(ServiceName) AS unique_services by src_ip, TargetUserName\n| where count > 5\n| eval alert = \"Possible Overpass-the-Hash: RC4 Kerberos tickets from \".src_ip\n| table _time, src_ip, TargetUserName, unique_services, count, alert\n```\n\n**Golden\u002FSilver Ticket Detection (T1558):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4769\n| where TicketOptions=\"0x40810000\" OR TicketOptions=\"0x40800000\"\n| eval ticket_lifetime = TicketExpireTime - TicketIssueTime\n| where ticket_lifetime > 36000  --- >10 hours (abnormal)\n| stats count by src_ip, TargetUserName, ServiceName, TicketEncryptionType, TicketOptions\n| eval alert = \"Possible Golden\u002FSilver Ticket: Abnormal ticket properties\"\n```\n\n### Step 2: Detect Remote Service Exploitation (T1021)\n\n**PsExec Detection (T1021.002):**\n```spl\n--- Via Sysmon process creation\nindex=sysmon EventCode=1\n(Image=\"*\\\\psexec.exe\" OR Image=\"*\\\\psexesvc.exe\"\n OR OriginalFileName=\"psexec.c\" OR OriginalFileName=\"psexesvc.exe\"\n OR ParentImage=\"*\\\\psexesvc.exe\")\n| table _time, Computer, User, ParentImage, Image, CommandLine, Hashes\n\n--- Via named pipe creation (Sysmon EventCode 17)\nindex=sysmon EventCode=17\nPipeName IN (\"\\\\PSEXESVC*\", \"\\\\RemCom*\", \"\\\\csexec*\")\n| table _time, Computer, User, Image, PipeName\n\n--- Via Windows service creation (EventCode 7045)\nindex=wineventlog sourcetype=\"WinEventLog:System\" EventCode=7045\nServiceName=\"PSEXESVC\" OR ServiceFileName=\"*PSEXESVC*\"\n| table _time, Computer, ServiceName, ServiceFileName, AccountName\n```\n\n**WMI Remote Execution (T1047):**\n```spl\nindex=sysmon EventCode=1\n(Image=\"*\\\\wmic.exe\" AND CommandLine=\"*\u002Fnode:*\")\nOR (ParentImage=\"*\\\\WmiPrvSE.exe\" AND Image IN (\"*\\\\cmd.exe\", \"*\\\\powershell.exe\"))\n| eval execution_type = case(\n    match(Image, \"wmic\"), \"WMI Command Line\",\n    match(ParentImage, \"WmiPrvSE\"), \"WMI Provider Host (remote execution)\"\n  )\n| table _time, Computer, User, execution_type, ParentImage, Image, CommandLine\n```\n\n**WinRM\u002FPowerShell Remoting (T1021.006):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624\nLogon_Type=3 AuthenticationPackageName=\"Kerberos\"\n| where ProcessName=\"*\\\\wsmprovhost.exe\" OR ProcessName=\"*\\\\powershell.exe\"\n| stats count, dc(ComputerName) AS unique_targets by src_ip, TargetUserName\n| where unique_targets > 2\n| eval alert = \"PowerShell Remoting to \".unique_targets.\" hosts from \".src_ip\n\n--- Sysmon variant\nindex=sysmon EventCode=1\nParentImage=\"*\\\\wsmprovhost.exe\"\nImage IN (\"*\\\\cmd.exe\", \"*\\\\powershell.exe\", \"*\\\\csc.exe\")\n| table _time, Computer, User, Image, CommandLine\n```\n\n**RDP Lateral Movement (T1021.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=10\n| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations,\n        earliest(_time) AS first_rdp, latest(_time) AS last_rdp\n  by src_ip, TargetUserName\n| where rdp_targets > 2\n| eval duration_hours = round((last_rdp - first_rdp) \u002F 3600, 1)\n| eval alert = TargetUserName.\" RDP'd to \".rdp_targets.\" hosts in \".duration_hours.\" hours\"\n| sort - rdp_targets\n```\n\n### Step 3: Detect SMB-Based Lateral Movement\n\n**Anomalous SMB Traffic Patterns:**\n```spl\nindex=firewall OR index=zeek sourcetype IN (\"pan:traffic\", \"bro:conn:json\")\ndest_port=445 action=allowed\n| where src_ip!=dest_ip\n| stats count AS smb_sessions, dc(dest_ip) AS unique_targets,\n        sum(bytes_out) AS total_bytes\n  by src_ip\n| where unique_targets > 10\n| eval alert = case(\n    unique_targets > 50, \"CRITICAL: Mass SMB enumeration from \".src_ip,\n    unique_targets > 20, \"HIGH: Significant SMB lateral movement\",\n    unique_targets > 10, \"MEDIUM: Elevated SMB connections\"\n  )\n| sort - unique_targets\n```\n\n**Admin Share Access (C$, ADMIN$):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=5140\nShareName IN (\"\\\\\\\\*\\\\C$\", \"\\\\\\\\*\\\\ADMIN$\", \"\\\\\\\\*\\\\IPC$\")\n| where SubjectUserName!=\"SYSTEM\" AND SubjectUserName!=\"$\"\n| stats count, dc(ComputerName) AS unique_hosts by SubjectUserName, ShareName, src_ip\n| where unique_hosts > 3\n| eval alert = \"Admin share access to \".unique_hosts.\" hosts by \".SubjectUserName\n| sort - unique_hosts\n```\n\n### Step 4: Build Lateral Movement Graph\n\nVisualize the attack path:\n\n```spl\n--- Build source->destination graph for authentication events\nindex=wineventlog EventCode=4624 Logon_Type IN (3, 10)\nearliest=-24h\n| stats count AS connections, latest(_time) AS last_connection\n  by src_ip, ComputerName, TargetUserName, Logon_Type\n| eval edge = src_ip.\" -> \".ComputerName.\" (User: \".TargetUserName.\", Type: \".Logon_Type.\")\"\n| sort - connections\n| table edge, connections, last_connection\n\n--- Network flow correlation\nindex=netflow earliest=-24h\ndest_port IN (445, 135, 3389, 5985, 5986)\n| stats sum(bytes) AS total_bytes, count AS flow_count,\n        dc(dest_ip) AS targets by src_ip, dest_port\n| where targets > 5\n| eval service = case(\n    dest_port=445, \"SMB\",\n    dest_port=135, \"RPC\u002FWMI\",\n    dest_port=3389, \"RDP\",\n    dest_port IN (5985, 5986), \"WinRM\"\n  )\n| sort - targets\n| table src_ip, service, targets, flow_count, total_bytes\n```\n\n### Step 5: Detect DCOM and Scheduled Task-Based Movement\n\n**DCOM Lateral Execution (T1021.003):**\n```spl\nindex=sysmon EventCode=1\nParentImage IN (\"*\\\\mmc.exe\", \"*\\\\excel.exe\", \"*\\\\outlook.exe\")\nImage IN (\"*\\\\cmd.exe\", \"*\\\\powershell.exe\", \"*\\\\mshta.exe\")\n| where ParentCommandLine=\"*-Embedding*\"\n| eval alert = \"DCOM-based lateral movement: \".ParentImage.\" spawned \".Image\n| table _time, Computer, User, ParentImage, Image, CommandLine, alert\n```\n\n**Remote Scheduled Task Creation (T1053.005):**\n```spl\nindex=wineventlog EventCode=4698\n| where SubjectUserName!=\"SYSTEM\"\n| eval task_xml = TaskContent\n| search task_xml=\"*http*\" OR task_xml=\"*powershell*\" OR task_xml=\"*cmd*\" OR task_xml=\"*\\\\Temp\\\\*\"\n| table _time, Computer, SubjectUserName, TaskName, task_xml\n```\n\n### Step 6: Correlate Movement with Kill Chain Phases\n\nBuild end-to-end attack chain detection:\n\n```spl\n--- Detect complete lateral movement sequence\nindex=wineventlog OR index=sysmon\n(EventCode=4625 OR EventCode=4624 OR EventCode=1 OR EventCode=4698 OR EventCode=5140)\n| eval phase = case(\n    EventCode=4625, \"1-Recon\u002FBruteForce\",\n    EventCode=4624 AND Logon_Type=3, \"2-Lateral Movement\",\n    EventCode=5140 AND match(ShareName, \"C\\$|ADMIN\\$\"), \"3-Admin Share Access\",\n    EventCode=1 AND match(ParentImage, \"psexesvc|WmiPrvSE|wsmprovhost\"), \"4-Remote Execution\",\n    EventCode=4698, \"5-Persistence (Scheduled Task)\",\n    1=1, \"other\"\n  )\n| where phase!=\"other\"\n| stats count by phase, src_ip, ComputerName, TargetUserName\n| sort phase, _time\n| table phase, src_ip, ComputerName, TargetUserName, count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Lateral Movement** | Post-compromise technique where attackers pivot between systems to reach targets |\n| **Pass-the-Hash** | Using stolen NTLM hash for authentication without knowing the plaintext password |\n| **Pass-the-Ticket** | Using stolen Kerberos TGT\u002FTGS tickets for authentication across the domain |\n| **PsExec** | Sysinternals tool (and attack technique) for remote process execution via SMB and named pipes |\n| **WMI Execution** | Using Windows Management Instrumentation for remote command execution via DCOM or WinRM |\n| **Admin Share** | Default Windows administrative shares (C$, ADMIN$, IPC$) used for remote system management |\n\n## Tools & Systems\n\n- **Splunk Enterprise Security**: SIEM platform for correlating Windows events, Sysmon, and network flows\n- **Microsoft Defender for Identity**: Cloud service detecting lateral movement via domain controller monitoring\n- **BloodHound**: Active Directory attack path analysis tool for identifying lateral movement opportunities\n- **CrowdStrike Falcon**: EDR platform with lateral movement detection and automated containment\n- **Zeek (Bro)**: Network monitor generating connection logs for SMB, RDP, and WinRM traffic analysis\n\n## Common Scenarios\n\n- **PsExec Spread**: Attacker uses PsExec to execute malware across 20 workstations — detect via service creation events\n- **RDP Pivoting**: Compromised VPN account used to RDP through multiple internal hosts — detect via Logon_Type 10 chains\n- **WMI Recon and Execution**: Attacker uses WMI for discovery then execution — detect via WmiPrvSE child processes\n- **Pass-the-Hash Campaign**: Stolen local admin hash used across subnet — detect via NTLM Logon_Type 3 to multiple hosts\n- **Scheduled Task Persistence**: Remote scheduled task created on domain controller — detect via EventCode 4698 from non-admin source\n\n## Output Format\n\n```\nLATERAL MOVEMENT DETECTION REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPeriod:       2024-03-15 14:00 to 18:00 UTC\nSource:       192.168.1.105 (WORKSTATION-042)\n\nMovement Path:\n  14:23  192.168.1.105 → 10.0.5.20  (DC-PRIMARY) — PtH via NTLM Type 3\n  14:25  10.0.5.20 → 10.0.5.21     (DC-BACKUP)  — Kerberos ticket reuse\n  14:28  10.0.5.20 → 10.0.10.15    (FILESERVER-01) — PsExec service creation\n  14:32  10.0.10.15 → 10.0.10.20   (DB-PRIMARY) — WMI remote execution\n  14:35  10.0.10.20 → 10.0.10.25   (DB-BACKUP)  — SMB admin share access\n\nTechniques Detected:\n  T1550.002 — Pass-the-Hash (NTLM authentication to DC)\n  T1021.002 — PsExec (remote service installation)\n  T1047     — WMI Execution (WmiPrvSE child process)\n  T1021.002 — SMB Admin Share (C$ access on DB-BACKUP)\n\nAffected Systems: 5 hosts across 2 network segments\nUser Account:     admin_compromised (Domain Admin)\nContainment:      All 5 hosts isolated at 14:45 UTC\n```\n","# Performing Lateral Movement Detection\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to detect attackers pivoting between systems after initial compromise\n- Incident investigations require tracking an attacker's movement path through the network\n- Detection engineering needs lateral movement rules mapped to ATT&CK TA0008 techniques\n- Red\u002Fpurple team exercises identify lateral movement detection gaps\n\n**Do not use** for detecting initial access or external attacks — lateral movement detection focuses on internal host-to-host pivot activity.\n\n## Prerequisites\n\n- Windows Security Event Logs (EventCode 4624, 4625, 4648, 4672) from all endpoints and servers\n- Sysmon deployed with process creation (EventCode 1), network connections (EventCode 3), and named pipe (EventCode 17\u002F18)\n- Network flow data (NetFlow\u002FsFlow, Zeek connection logs) for internal traffic analysis\n- SIEM with cross-source correlation capability\n- Baseline of normal internal authentication patterns\n\n## Workflow\n\n### Step 1: Detect Pass-the-Hash \u002F Pass-the-Ticket (T1550)\n\n**Pass-the-Hash Detection (EventCode 4624 with NTLM):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=3\nAuthenticationPackageName=\"NTLM\"\n| where TargetUserName!=\"ANONYMOUS LOGON\" AND TargetUserName!=\"$\"\n| stats count, dc(ComputerName) AS unique_targets, values(ComputerName) AS targets\n  by src_ip, TargetUserName\n| where unique_targets > 3\n| eval alert = \"Possible Pass-the-Hash: NTLM network logon to \".unique_targets.\" hosts\"\n| sort - unique_targets\n| table src_ip, TargetUserName, unique_targets, count, targets, alert\n```\n\n**Overpass-the-Hash Detection (Kerberos with RC4):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4769\nTicketEncryptionType=\"0x17\"\n| where ServiceName!=\"krbtgt\" AND ServiceName!=\"$\"\n| stats count, dc(ServiceName) AS unique_services by src_ip, TargetUserName\n| where count > 5\n| eval alert = \"Possible Overpass-the-Hash: RC4 Kerberos tickets from \".src_ip\n| table _time, src_ip, TargetUserName, unique_services, count, alert\n```\n\n**Golden\u002FSilver Ticket Detection (T1558):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4769\n| where TicketOptions=\"0x40810000\" OR TicketOptions=\"0x40800000\"\n| eval ticket_lifetime = TicketExpireTime - TicketIssueTime\n| where ticket_lifetime > 36000  --- >10 hours (abnormal)\n| stats count by src_ip, TargetUserName, ServiceName, TicketEncryptionType, TicketOptions\n| eval alert = \"Possible Golden\u002FSilver Ticket: Abnormal ticket properties\"\n```\n\n### Step 2: Detect Remote Service Exploitation (T1021)\n\n**PsExec Detection (T1021.002):**\n```spl\n--- Via Sysmon process creation\nindex=sysmon EventCode=1\n(Image=\"*\\\\psexec.exe\" OR Image=\"*\\\\psexesvc.exe\"\n OR OriginalFileName=\"psexec.c\" OR OriginalFileName=\"psexesvc.exe\"\n OR ParentImage=\"*\\\\psexesvc.exe\")\n| table _time, Computer, User, ParentImage, Image, CommandLine, Hashes\n\n--- Via named pipe creation (Sysmon EventCode 17)\nindex=sysmon EventCode=17\nPipeName IN (\"\\\\PSEXESVC*\", \"\\\\RemCom*\", \"\\\\csexec*\")\n| table _time, Computer, User, Image, PipeName\n\n--- Via Windows service creation (EventCode 7045)\nindex=wineventlog sourcetype=\"WinEventLog:System\" EventCode=7045\nServiceName=\"PSEXESVC\" OR ServiceFileName=\"*PSEXESVC*\"\n| table _time, Computer, ServiceName, ServiceFileName, AccountName\n```\n\n**WMI Remote Execution (T1047):**\n```spl\nindex=sysmon EventCode=1\n(Image=\"*\\\\wmic.exe\" AND CommandLine=\"*\u002Fnode:*\")\nOR (ParentImage=\"*\\\\WmiPrvSE.exe\" AND Image IN (\"*\\\\cmd.exe\", \"*\\\\powershell.exe\"))\n| eval execution_type = case(\n    match(Image, \"wmic\"), \"WMI Command Line\",\n    match(ParentImage, \"WmiPrvSE\"), \"WMI Provider Host (remote execution)\"\n  )\n| table _time, Computer, User, execution_type, ParentImage, Image, CommandLine\n```\n\n**WinRM\u002FPowerShell Remoting (T1021.006):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624\nLogon_Type=3 AuthenticationPackageName=\"Kerberos\"\n| where ProcessName=\"*\\\\wsmprovhost.exe\" OR ProcessName=\"*\\\\powershell.exe\"\n| stats count, dc(ComputerName) AS unique_targets by src_ip, TargetUserName\n| where unique_targets > 2\n| eval alert = \"PowerShell Remoting to \".unique_targets.\" hosts from \".src_ip\n\n--- Sysmon variant\nindex=sysmon EventCode=1\nParentImage=\"*\\\\wsmprovhost.exe\"\nImage IN (\"*\\\\cmd.exe\", \"*\\\\powershell.exe\", \"*\\\\csc.exe\")\n| table _time, Computer, User, Image, CommandLine\n```\n\n**RDP Lateral Movement (T1021.001):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=4624 Logon_Type=10\n| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations,\n        earliest(_time) AS first_rdp, latest(_time) AS last_rdp\n  by src_ip, TargetUserName\n| where rdp_targets > 2\n| eval duration_hours = round((last_rdp - first_rdp) \u002F 3600, 1)\n| eval alert = TargetUserName.\" RDP'd to \".rdp_targets.\" hosts in \".duration_hours.\" hours\"\n| sort - rdp_targets\n```\n\n### Step 3: Detect SMB-Based Lateral Movement\n\n**Anomalous SMB Traffic Patterns:**\n```spl\nindex=firewall OR index=zeek sourcetype IN (\"pan:traffic\", \"bro:conn:json\")\ndest_port=445 action=allowed\n| where src_ip!=dest_ip\n| stats count AS smb_sessions, dc(dest_ip) AS unique_targets,\n        sum(bytes_out) AS total_bytes\n  by src_ip\n| where unique_targets > 10\n| eval alert = case(\n    unique_targets > 50, \"CRITICAL: Mass SMB enumeration from \".src_ip,\n    unique_targets > 20, \"HIGH: Significant SMB lateral movement\",\n    unique_targets > 10, \"MEDIUM: Elevated SMB connections\"\n  )\n| sort - unique_targets\n```\n\n**Admin Share Access (C$, ADMIN$):**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\" EventCode=5140\nShareName IN (\"\\\\\\\\*\\\\C$\", \"\\\\\\\\*\\\\ADMIN$\", \"\\\\\\\\*\\\\IPC$\")\n| where SubjectUserName!=\"SYSTEM\" AND SubjectUserName!=\"$\"\n| stats count, dc(ComputerName) AS unique_hosts by SubjectUserName, ShareName, src_ip\n| where unique_hosts > 3\n| eval alert = \"Admin share access to \".unique_hosts.\" hosts by \".SubjectUserName\n| sort - unique_hosts\n```\n\n### Step 4: Build Lateral Movement Graph\n\nVisualize the attack path:\n\n```spl\n--- Build source->destination graph for authentication events\nindex=wineventlog EventCode=4624 Logon_Type IN (3, 10)\nearliest=-24h\n| stats count AS connections, latest(_time) AS last_connection\n  by src_ip, ComputerName, TargetUserName, Logon_Type\n| eval edge = src_ip.\" -> \".ComputerName.\" (User: \".TargetUserName.\", Type: \".Logon_Type.\")\"\n| sort - connections\n| table edge, connections, last_connection\n\n--- Network flow correlation\nindex=netflow earliest=-24h\ndest_port IN (445, 135, 3389, 5985, 5986)\n| stats sum(bytes) AS total_bytes, count AS flow_count,\n        dc(dest_ip) AS targets by src_ip, dest_port\n| where targets > 5\n| eval service = case(\n    dest_port=445, \"SMB\",\n    dest_port=135, \"RPC\u002FWMI\",\n    dest_port=3389, \"RDP\",\n    dest_port IN (5985, 5986), \"WinRM\"\n  )\n| sort - targets\n| table src_ip, service, targets, flow_count, total_bytes\n```\n\n### Step 5: Detect DCOM and Scheduled Task-Based Movement\n\n**DCOM Lateral Execution (T1021.003):**\n```spl\nindex=sysmon EventCode=1\nParentImage IN (\"*\\\\mmc.exe\", \"*\\\\excel.exe\", \"*\\\\outlook.exe\")\nImage IN (\"*\\\\cmd.exe\", \"*\\\\powershell.exe\", \"*\\\\mshta.exe\")\n| where ParentCommandLine=\"*-Embedding*\"\n| eval alert = \"DCOM-based lateral movement: \".ParentImage.\" spawned \".Image\n| table _time, Computer, User, ParentImage, Image, CommandLine, alert\n```\n\n**Remote Scheduled Task Creation (T1053.005):**\n```spl\nindex=wineventlog EventCode=4698\n| where SubjectUserName!=\"SYSTEM\"\n| eval task_xml = TaskContent\n| search task_xml=\"*http*\" OR task_xml=\"*powershell*\" OR task_xml=\"*cmd*\" OR task_xml=\"*\\\\Temp\\\\*\"\n| table _time, Computer, SubjectUserName, TaskName, task_xml\n```\n\n### Step 6: Correlate Movement with Kill Chain Phases\n\nBuild end-to-end attack chain detection:\n\n```spl\n--- Detect complete lateral movement sequence\nindex=wineventlog OR index=sysmon\n(EventCode=4625 OR EventCode=4624 OR EventCode=1 OR EventCode=4698 OR EventCode=5140)\n| eval phase = case(\n    EventCode=4625, \"1-Recon\u002FBruteForce\",\n    EventCode=4624 AND Logon_Type=3, \"2-Lateral Movement\",\n    EventCode=5140 AND match(ShareName, \"C\\$|ADMIN\\$\"), \"3-Admin Share Access\",\n    EventCode=1 AND match(ParentImage, \"psexesvc|WmiPrvSE|wsmprovhost\"), \"4-Remote Execution\",\n    EventCode=4698, \"5-Persistence (Scheduled Task)\",\n    1=1, \"other\"\n  )\n| where phase!=\"other\"\n| stats count by phase, src_ip, ComputerName, TargetUserName\n| sort phase, _time\n| table phase, src_ip, ComputerName, TargetUserName, count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Lateral Movement** | Post-compromise technique where attackers pivot between systems to reach targets |\n| **Pass-the-Hash** | Using stolen NTLM hash for authentication without knowing the plaintext password |\n| **Pass-the-Ticket** | Using stolen Kerberos TGT\u002FTGS tickets for authentication across the domain |\n| **PsExec** | Sysinternals tool (and attack technique) for remote process execution via SMB and named pipes |\n| **WMI Execution** | Using Windows Management Instrumentation for remote command execution via DCOM or WinRM |\n| **Admin Share** | Default Windows administrative shares (C$, ADMIN$, IPC$) used for remote system management |\n\n## Tools & Systems\n\n- **Splunk Enterprise Security**: SIEM platform for correlating Windows events, Sysmon, and network flows\n- **Microsoft Defender for Identity**: Cloud service detecting lateral movement via domain controller monitoring\n- **BloodHound**: Active Directory attack path analysis tool for identifying lateral movement opportunities\n- **CrowdStrike Falcon**: EDR platform with lateral movement detection and automated containment\n- **Zeek (Bro)**: Network monitor generating connection logs for SMB, RDP, and WinRM traffic analysis\n\n## Common Scenarios\n\n- **PsExec Spread**: Attacker uses PsExec to execute malware across 20 workstations — detect via service creation events\n- **RDP Pivoting**: Compromised VPN account used to RDP through multiple internal hosts — detect via Logon_Type 10 chains\n- **WMI Recon and Execution**: Attacker uses WMI for discovery then execution — detect via WmiPrvSE child processes\n- **Pass-the-Hash Campaign**: Stolen local admin hash used across subnet — detect via NTLM Logon_Type 3 to multiple hosts\n- **Scheduled Task Persistence**: Remote scheduled task created on domain controller — detect via EventCode 4698 from non-admin source\n\n## Output Format\n\n```\nLATERAL MOVEMENT DETECTION REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPeriod:       2024-03-15 14:00 to 18:00 UTC\nSource:       192.168.1.105 (WORKSTATION-042)\n\nMovement Path:\n  14:23  192.168.1.105 → 10.0.5.20  (DC-PRIMARY) — PtH via NTLM Type 3\n  14:25  10.0.5.20 → 10.0.5.21     (DC-BACKUP)  — Kerberos ticket reuse\n  14:28  10.0.5.20 → 10.0.10.15    (FILESERVER-01) — PsExec service creation\n  14:32  10.0.10.15 → 10.0.10.20   (DB-PRIMARY) — WMI remote execution\n  14:35  10.0.10.20 → 10.0.10.25   (DB-BACKUP)  — SMB admin share access\n\nTechniques Detected:\n  T1550.002 — Pass-the-Hash (NTLM authentication to DC)\n  T1021.002 — PsExec (remote service installation)\n  T1047     — WMI Execution (WmiPrvSE child process)\n  T1021.002 — SMB Admin Share (C$ access on DB-BACKUP)\n\nAffected Systems: 5 hosts across 2 network segments\nUser Account:     admin_compromised (Domain Admin)\nContainment:      All 5 hosts isolated at 14:45 UTC\n```\n",{"name":5,"tags":49,"author":52,"domain":34,"license":15,"version":53,"nist_csf":54,"subdomain":59,"description":60,"mitre_attack":61,"d3fend_techniques":67},[40,26,41,33,50,51,30,31,25],"psexec","wmi","mahipal","1.0",[55,56,57,58],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading by correlating Windows Security\u002FSysmon event logs, network flow data (NetFlow\u002FZeek), and endpoint telemetry in a SIEM, mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques with sample SPL detection queries. Use when a SOC team needs to detect attackers pivoting between internal systems after initial compromise, trace an attacker's movement path during an incident investigation, or build detection engineering rules for TA0008; not for detecting initial access or external attacks.\n",[62,63,64,65,66],"T1078","T1685.002","T1685.005","T1566","T1021",[68,69,70,71,72],"Token Binding","Execution Isolation","Restore Access","Application Protocol Command Analysis","Process Termination","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-lateral-movement-detection",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-lateral-movement-detection",{"tool":89,"command":90},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-lateral-movement-detection",{"tool":92,"command":93},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-lateral-movement-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-detection\u002FSKILL.md",true,[97,102,108],{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-detection\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",1793,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-detection\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fagent.py","SCRIPT","脚本",8962,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-lateral-movement-detection\u002Fscripts\u002Fagent.py",[115,142,166,192,216,243],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[123,124,125,126,127,34,128,129,130,131,132,133,134,135,136,137,138,139,140,141],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[150,138,151,152,127,153,34,130,154,155,156,157,158,159,160,161,162,163,164,165],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":176,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[172,175],{"categoryNo":173,"categoryName":174,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[160,177,178,179,180,34,181,182,154,183,184,185,186,187,25,29,188,189,190,191],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[198],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[200,201,202,34,203,204,42,205,206,207,208,37,209,210,211,212,157,213,214,215],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[222],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,34,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[249],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,251,34,43,252,253,40,254,255,256,257,29,258,188,27,259,260,261,262,263],"triaging security incident","file","ioc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]