[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FNMEH0Z82ZJF5ED27Z8AX":3,"skill-same:01M71FNMEH0Z82ZJF5ED27Z8AX":98},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":14,"repositoryHtmlUrl":74,"repositoryHomepageUrl":6,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M71FNMEH0Z82ZJF5ED27Z8AX","lateral-movement-detection-splunk-detect",null,"Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Flateral-movement\u002Fdetection-splunk\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"lateral movement detection splunk detect","lateral movement","detect","splunk","detection","analysis","traffic","remote","across","community","cm","Bash","cybersecurity","smb","ta0008","mitre-attack","server","logs","authentication","siem","2026-11-10 10:12:30",false,"---\nname: lateral-movement-detection-splunk-detect\ndescription: Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- mitre-attack\n- lateral-movement\n- splunk\n- siem\n- proactive-detection\n- ta0008\nd3fend_techniques:\n- Application Protocol Command Analysis\n- Network Isolation\n- Network Traffic Analysis\n- Client-server Payload Profiling\n- Network Traffic Community Deviation\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1003\n- T1021\n- T1059\n- T1070\ncapec: []\n---\n\n# Detecting Lateral Movement with Splunk\n\n## When to Use\n\n- When hunting for adversary movement between compromised systems\n- After detecting credential theft to trace subsequent lateral activity\n- When investigating unusual authentication patterns across the network\n- During incident response to scope the breadth of compromise\n- When proactively hunting for TA0008 (Lateral Movement) techniques\n\n## Prerequisites\n\n- Splunk Enterprise or Splunk Cloud with Windows event data ingested\n- Windows Security Event Logs forwarded (4624, 4625, 4648, 4672, 4768, 4769)\n- Sysmon deployed for process creation and network connection data\n- Network flow data or firewall logs for SMB\u002FRDP\u002FWinRM correlation\n- Active Directory user and group membership reference data\n\n## Workflow\n\n1. **Define Lateral Movement Scope**: Identify which lateral movement techniques to hunt (RDP, SMB\u002FAdmin Shares, WinRM, PsExec, WMI, DCOM, SSH).\n2. **Query Authentication Events**: Use SPL to search for Type 3 (Network) and Type 10 (RemoteInteractive) logons across the environment.\n3. **Build Authentication Graphs**: Map source-to-destination authentication relationships to identify unusual connection patterns.\n4. **Detect First-Time Relationships**: Identify new source-destination pairs that have not been seen in the historical baseline.\n5. **Correlate with Process Activity**: Link authentication events to subsequent process creation on destination hosts.\n6. **Identify Anomalous Patterns**: Flag lateral movement to sensitive servers, unusual hours, service account misuse, or rapid multi-host access.\n7. **Report and Contain**: Document lateral movement path, affected systems, and coordinate containment response.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1021 | Remote Services (parent technique) |\n| T1021.001 | Remote Desktop Protocol (RDP) |\n| T1021.002 | SMB\u002FWindows Admin Shares |\n| T1021.003 | Distributed COM (DCOM) |\n| T1021.004 | SSH |\n| T1021.006 | Windows Remote Management (WinRM) |\n| T1570 | Lateral Tool Transfer |\n| T1047 | Windows Management Instrumentation |\n| T1569.002 | Service Execution (PsExec) |\n| Logon Type 3 | Network logon (SMB, WinRM, mapped drives) |\n| Logon Type 10 | Remote Interactive (RDP) |\n| Event ID 4624 | Successful logon |\n| Event ID 4648 | Explicit credential logon (runas, PsExec) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Splunk Enterprise | SIEM for log aggregation and SPL queries |\n| Splunk Enterprise Security | Threat detection and notable events |\n| Windows Event Forwarding | Centralize Windows logs |\n| Sysmon | Detailed process and network telemetry |\n| BloodHound | AD attack path analysis |\n| PingCastle | AD security assessment |\n\n## Common Scenarios\n\n1. **PsExec Lateral Movement**: Adversary uses PsExec to execute commands on remote systems via SMB, generating Type 3 logon with ADMIN$ share access.\n2. **RDP Pivoting**: Attacker RDPs to internal systems using stolen credentials, creating Type 10 logon events.\n3. **WMI Remote Execution**: Adversary uses WMIC process call create to spawn processes on remote hosts.\n4. **WinRM PowerShell Remoting**: Attacker uses Enter-PSSession or Invoke-Command to execute code on remote systems.\n5. **Pass-the-Hash via SMB**: Compromised NTLM hashes used to authenticate to remote systems without knowing the plaintext password.\n\n## Output Format\n\n```\nHunt ID: TH-LATMOV-[DATE]-[SEQ]\nMovement Type: [RDP\u002FSMB\u002FWinRM\u002FWMI\u002FDCOM\u002FPsExec]\nSource Host: [Hostname\u002FIP]\nDestination Host: [Hostname\u002FIP]\nAccount Used: [Username]\nLogon Type: [3\u002F10\u002Fother]\nFirst Seen: [Timestamp]\nEvent Count: [Number of events]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nLateral Movement Path: [A -> B -> C -> D]\n```\n","# Detecting Lateral Movement with Splunk\n\n## When to Use\n\n- When hunting for adversary movement between compromised systems\n- After detecting credential theft to trace subsequent lateral activity\n- When investigating unusual authentication patterns across the network\n- During incident response to scope the breadth of compromise\n- When proactively hunting for TA0008 (Lateral Movement) techniques\n\n## Prerequisites\n\n- Splunk Enterprise or Splunk Cloud with Windows event data ingested\n- Windows Security Event Logs forwarded (4624, 4625, 4648, 4672, 4768, 4769)\n- Sysmon deployed for process creation and network connection data\n- Network flow data or firewall logs for SMB\u002FRDP\u002FWinRM correlation\n- Active Directory user and group membership reference data\n\n## Workflow\n\n1. **Define Lateral Movement Scope**: Identify which lateral movement techniques to hunt (RDP, SMB\u002FAdmin Shares, WinRM, PsExec, WMI, DCOM, SSH).\n2. **Query Authentication Events**: Use SPL to search for Type 3 (Network) and Type 10 (RemoteInteractive) logons across the environment.\n3. **Build Authentication Graphs**: Map source-to-destination authentication relationships to identify unusual connection patterns.\n4. **Detect First-Time Relationships**: Identify new source-destination pairs that have not been seen in the historical baseline.\n5. **Correlate with Process Activity**: Link authentication events to subsequent process creation on destination hosts.\n6. **Identify Anomalous Patterns**: Flag lateral movement to sensitive servers, unusual hours, service account misuse, or rapid multi-host access.\n7. **Report and Contain**: Document lateral movement path, affected systems, and coordinate containment response.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1021 | Remote Services (parent technique) |\n| T1021.001 | Remote Desktop Protocol (RDP) |\n| T1021.002 | SMB\u002FWindows Admin Shares |\n| T1021.003 | Distributed COM (DCOM) |\n| T1021.004 | SSH |\n| T1021.006 | Windows Remote Management (WinRM) |\n| T1570 | Lateral Tool Transfer |\n| T1047 | Windows Management Instrumentation |\n| T1569.002 | Service Execution (PsExec) |\n| Logon Type 3 | Network logon (SMB, WinRM, mapped drives) |\n| Logon Type 10 | Remote Interactive (RDP) |\n| Event ID 4624 | Successful logon |\n| Event ID 4648 | Explicit credential logon (runas, PsExec) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Splunk Enterprise | SIEM for log aggregation and SPL queries |\n| Splunk Enterprise Security | Threat detection and notable events |\n| Windows Event Forwarding | Centralize Windows logs |\n| Sysmon | Detailed process and network telemetry |\n| BloodHound | AD attack path analysis |\n| PingCastle | AD security assessment |\n\n## Common Scenarios\n\n1. **PsExec Lateral Movement**: Adversary uses PsExec to execute commands on remote systems via SMB, generating Type 3 logon with ADMIN$ share access.\n2. **RDP Pivoting**: Attacker RDPs to internal systems using stolen credentials, creating Type 10 logon events.\n3. **WMI Remote Execution**: Adversary uses WMIC process call create to spawn processes on remote hosts.\n4. **WinRM PowerShell Remoting**: Attacker uses Enter-PSSession or Invoke-Command to execute code on remote systems.\n5. **Pass-the-Hash via SMB**: Compromised NTLM hashes used to authenticate to remote systems without knowing the plaintext password.\n\n## Output Format\n\n```\nHunt ID: TH-LATMOV-[DATE]-[SEQ]\nMovement Type: [RDP\u002FSMB\u002FWinRM\u002FWMI\u002FDCOM\u002FPsExec]\nSource Host: [Hostname\u002FIP]\nDestination Host: [Hostname\u002FIP]\nAccount Used: [Username]\nLogon Type: [3\u002F10\u002Fother]\nFirst Seen: [Timestamp]\nEvent Count: [Number of events]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nLateral Movement Path: [A -> B -> C -> D]\n```\n",{"name":5,"tags":44,"capec":48,"model":49,"tools":50,"domain":31,"maxTurns":54,"nist_csf":55,"subdomain":45,"description":7,"mitre_attack":60,"d3fend_techniques":65},[45,34,46,22,38,47,33],"threat-hunting","lateral-movement","proactive-detection",[],"sonnet",[51,30,52,53],"Read","Glob","Grep",20,[56,57,58,59],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[61,62,63,64],"T1003","T1021","T1059","T1070",[66,67,68,69,70],"Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Flateral-movement\u002Fdetection-splunk\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill lateral-movement-detection-splunk-detect",{"tool":84,"command":85},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill lateral-movement-detection-splunk-detect",{"tool":87,"command":88},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill lateral-movement-detection-splunk-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Flateral-movement\u002Fdetection-splunk\u002Fdetect\u002FSKILL.md",true,[92],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"index.json","REFERENCE","参考文档",685,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Flateral-movement\u002Fdetection-splunk\u002Fdetect\u002Findex.json",[99,122,138,159,181,197],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[106,21,107,108,109,110,29,111,112,113,114,115,116,117,118,119,120,31,121],"services","services wmi persistence detect","wmi","persistence","de","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[129,106,130,108,131,26,25,31,30,24,132,27,133,134,110,135,20,136,46,137],"exploit","services wmi exec exploit","exec","team","crackmapexec","native","command","read","Impacket",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[145,146,147,148,149,150,31,30,151,24,152,153,110,136,154,155,156,157,158,49],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,166,167,168,169,170,171,29,172,31,121,173,174,175,176,177,178,179,180,110],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[188,189,21,190,168,170,191,29,192,172,31,121,24,193,194,195,196,180,110,111],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,21,168,205,191,29,206,207,31,121,208,209,210,211,212,213,110,111,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]