detecting-lateral-movement-in-network

Detecting Lateral Movement in Network When to Use - Monitoring enterprise networks for post-compromise lateral movement patterns (pass-the-hash, RDP hopping, PSExec) - Building SIEM detection rules and alerts for common MITRE ATT&CK lateral movement techniques (T1021, T1570) - Investigating suspected breaches by analyzing authentication patterns and network connections between internal hosts - Hunting for anomalous east-west traffic patterns that indicate an attacker pivoting through the network - Validating that network segmentation and access controls effectively limit lateral movement path…

\n condition: selection and not filter\n timeframe: 15m\n count:\n field: ComputerName\n min: 3\n group-by: TargetUserName\nlevel: high\ntags:\n - attack.lateral_movement\n - attack.t1550.002\nEOF\n\n# Convert Sigma rule to Splunk SPL\nsigma convert -t splunk lateral_movement_pth.yml\n\n# Convert to Elastic query\nsigma convert -t elasticsearch lateral_movement_pth.yml\n```\n\n### Step 3: Network-Level Detection with Zeek\n\n```bash\n# Detect SMB lateral movement (admin$ and c$ share access)\ncat /opt/zeek/logs/current/smb_mapping.log | \\\n zeek-cut ts id.orig_h id.resp_h path | \\\n grep -iE \"(admin\\$|c\\$|ipc\\$)\" | \\\n sort -t

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\t' -k2 | uniq -c | sort -rn\n\n# Detect hosts connecting to many internal hosts on port 445 (SMB spreading)\ncat /opt/zeek/logs/current/conn.log | \\\n zeek-cut ts id.orig_h id.resp_h id.resp_p | \\\n awk '$4 == 445' | \\\n awk '{print $2}' | sort | uniq -c | sort -rn | head -10\n\n# Detect WMI lateral movement (DCE-RPC to IWbemServices)\ncat /opt/zeek/logs/current/dce_rpc.log | \\\n zeek-cut ts id.orig_h id.resp_h operation | \\\n grep -i \"wbem\\|wmi\" | sort | uniq -c | sort -rn\n\n# Detect RDP connections between internal hosts\ncat /opt/zeek/logs/current/conn.log | \\\n zeek-cut ts id.orig_h id.resp_h id.resp_p duration | \\\n awk '$4 == 3389 && $5 > 60' | \\\n sort -t

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\t' -k2 | head -20\n\n# Detect Kerberos ticket-granting anomalies\ncat /opt/zeek/logs/current/kerberos.log | \\\n zeek-cut ts id.orig_h id.resp_h client service success error_msg | \\\n grep -v \"true\" | head -20\n\n# Custom Zeek script for lateral movement detection\nsudo tee /opt/zeek/share/zeek/site/custom-detections/lateral-movement.zeek \u003c\u003c 'ZEEKEOF'\n@load base/frameworks/notice\n@load base/frameworks/sumstats\n\nmodule LateralMovement;\n\nexport {\n redef enum Notice::Type += {\n SMB_Lateral_Spread,\n RDP_Lateral_Chain\n };\n const smb_host_threshold: count = 5 &redef;\n const smb_time_window: interval = 15min &redef;\n}\n\nevent zeek_init()\n{\n local r1 = SumStats::Reducer(\n $stream=\"lateral.smb\",\n $apply=set(SumStats::UNIQUE)\n );\n\n SumStats::create([\n $name=\"detect-smb-lateral\",\n $epoch=smb_time_window,\n $reducers=set(r1),\n $threshold_val(key: SumStats::Key, result: SumStats::Result) = {\n return result[\"lateral.smb\"]$unique + 0.0;\n },\n $threshold=smb_host_threshold + 0.0,\n $threshold_crossed(key: SumStats::Key, result: SumStats::Result) = {\n NOTICE([\n $note=SMB_Lateral_Spread,\n $msg=fmt(\"Host %s connected to %d SMB hosts in %s\",\n key$str, result[\"lateral.smb\"]$unique, smb_time_window),\n $identifier=key$str\n ]);\n }\n ]);\n}\n\nevent connection_state_remove(c: connection)\n{\n if ( c$id$resp_p == 445/tcp && c$id$resp_h in Site::local_nets )\n {\n SumStats::observe(\"lateral.smb\",\n [$str=cat(c$id$orig_h)],\n [$str=cat(c$id$resp_h)]\n );\n }\n}\nZEEKEOF\n\nsudo zeekctl deploy\n```\n\n### Step 4: Threat Hunting for Lateral Movement Indicators\n\n```bash\n# Hunt for authentication anomalies in Windows logs\n# Splunk query: Users authenticating from unusual source hosts\n# index=wineventlog EventCode=4624 LogonType=3\n# | stats values(IpAddress) as source_ips dc(IpAddress) as source_count by TargetUserName\n# | where source_count > 5\n# | sort -source_count\n\n# Hunt for service accounts used interactively\n# index=wineventlog EventCode=4624 (LogonType=2 OR LogonType=10)\n# | where match(TargetUserName, \"^svc-.*\")\n# | table _time ComputerName TargetUserName IpAddress LogonType\n\n# Network flow analysis for lateral movement patterns\n# Look for hosts that suddenly start communicating with many internal hosts\ncat /opt/zeek/logs/current/conn.log | \\\n zeek-cut ts id.orig_h id.resp_h | \\\n awk '{\n key = $2\n targets[key][$3] = 1\n }\n END {\n for (src in targets) {\n count = 0\n for (dst in targets[src]) count++\n if (count > 20) print src, count\n }\n }' | sort -k2 -rn\n\n# Detect credential dumping artifacts (large LSASS reads)\n# Look for connections from hosts that suddenly pivot\ncat /opt/zeek/logs/current/conn.log | \\\n zeek-cut ts id.orig_h id.resp_h id.resp_p orig_bytes | \\\n awk '$4 == 445 && $5 > 10000000' | sort -t

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\t' -k5 -rn\n\n# Timeline analysis: map the attack path\n# index=wineventlog (EventCode=4624 OR EventCode=7045)\n# | eval stage=case(\n# EventCode=4624 AND LogonType=3, \"Network Logon\",\n# EventCode=4624 AND LogonType=10, \"RDP Logon\",\n# EventCode=7045, \"Service Creation\"\n# )\n# | timechart span=5m count by stage\n```\n\n### Step 5: Automated Response and Containment\n\n```bash\n# SOAR playbook for lateral movement response (pseudocode)\n# When lateral movement alert triggers:\n\n# 1. Enrich the alert with context\n# - Query AD for user group membership and role\n# - Check if source IP is a known admin workstation\n# - Look up recent vulnerability scan results for affected hosts\n\n# 2. Automated containment actions\n# Option A: Isolate the host via switch port shutdown\n# ssh admin@switch \"conf t; interface Gi1/0/5; shutdown\"\n\n# Option B: Quarantine via VLAN change (less disruptive)\n# ssh admin@switch \"conf t; interface Gi1/0/5; switchport access vlan 999\"\n\n# Option C: Block at firewall\nsudo iptables -I FORWARD -s 10.10.5.23 -j DROP\n\n# 3. Disable the compromised account\n# PowerShell: Disable-ADAccount -Identity compromised_user\n\n# 4. Force password reset\n# PowerShell: Set-ADAccountPassword -Identity compromised_user -Reset\n\n# 5. Collect forensic evidence before full containment\n# velociraptor artifact collect Windows.KapeFiles.Targets --target BasicCollection\n```\n\n### Step 6: Build Detection Dashboard\n\n```bash\n# Elastic Kibana dashboard queries for lateral movement monitoring\n\n# Panel 1: Authentication heatmap (source vs destination)\n# Aggregation: Terms on source.ip (rows) and destination.ip (columns)\n# Metric: Count of event.code:4624\n\n# Panel 2: SMB connections between internal hosts\n# Filter: destination.port:445 and source.ip:10.0.0.0/8\n# Aggregation: Top 20 source IPs by unique destination count\n\n# Panel 3: RDP sessions timeline\n# Filter: destination.port:3389 and event.code:4624 and winlog.event_data.LogonType:10\n# Visualization: Timeline by source.ip\n\n# Panel 4: New service installations\n# Filter: event.code:7045\n# Aggregation: Terms on winlog.event_data.ServiceName\n\n# Panel 5: Failed authentication spike detection\n# Filter: event.code:4625\n# Aggregation: Date histogram with anomaly detection\n\n# Export Kibana dashboard\n# curl -X GET \"elastic-siem:5601/api/saved_objects/_export\" \\\n# -H \"kbn-xsrf: true\" \\\n# -d '{\"type\":\"dashboard\",\"objects\":[{\"id\":\"lateral-movement-dashboard\",\"type\":\"dashboard\"}]}' \\\n# > lateral_movement_dashboard.ndjson\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Lateral Movement** | MITRE ATT&CK tactic (TA0008) describing techniques attackers use to move through a network from one compromised system to another |\n| **Pass-the-Hash (T1550.002)** | Using captured NTLM password hashes to authenticate to remote systems without knowing the plaintext password |\n| **PsExec (T1569.002)** | Remote service execution tool that creates a temporary service on the target system, detectable by Event ID 7045 |\n| **East-West Traffic** | Network communication between internal systems (as opposed to north-south traffic between internal and external networks) |\n| **Authentication Anomaly** | Deviation from baseline authentication patterns such as a user logging into systems they never accessed before |\n| **Kerberoasting (T1558.003)** | Requesting Kerberos service tickets for service accounts and cracking them offline, detectable via Event ID 4769 anomalies |\n\n## Tools & Systems\n\n- **Zeek**: Network security monitor generating SMB, Kerberos, DCE-RPC, and connection logs for lateral movement analysis\n- **Splunk/Elastic SIEM**: Log aggregation platforms for correlating authentication events, network flows, and service creation across the enterprise\n- **Sigma**: Vendor-agnostic detection rule format for writing portable lateral movement detection rules across SIEM platforms\n- **Velociraptor**: Endpoint forensics tool for collecting evidence from hosts involved in lateral movement chains\n- **BloodHound**: Active Directory attack path analysis tool for identifying potential lateral movement routes before attackers exploit them\n\n## Common Scenarios\n\n### Scenario: Detecting a Ransomware Operator's Lateral Movement\n\n**Context**: The SOC receives an alert for PsExec service creation on a file server (10.10.20.15) at 2:00 AM. The alert triggers a lateral movement investigation. The organization has Zeek network monitoring and Windows Event Log forwarding to Splunk.\n\n**Approach**:\n1. Query Splunk for Event ID 7045 (service creation) on 10.10.20.15 to confirm PsExec execution and identify the source IP (10.10.5.23)\n2. Trace authentication history for 10.10.5.23: find Event ID 4624 Type 3 logons, discovering the host authenticated to 8 servers in the past hour using NTLM (pass-the-hash pattern)\n3. Check Zeek conn.log for 10.10.5.23: identify SMB connections (port 445) to 12 internal hosts and large file transfers to an external IP\n4. Build the attack timeline: initial compromise via phishing at 1:15 AM, credential dumping at 1:25 AM, lateral movement to 8 servers between 1:30-2:00 AM\n5. Identify all compromised hosts by tracing authentication chains: 10.10.5.23 -> 10.10.20.15 -> 10.10.20.16 -> 10.10.20.17\n6. Contain by quarantining all identified hosts to VLAN 999, disabling the compromised account, and blocking the external C2 IP\n7. Report the complete attack chain with timeline, affected hosts, and detection gaps\n\n**Pitfalls**:\n- Only investigating the single alert instead of tracing the full lateral movement chain across all hosts\n- Not checking for persistence mechanisms on each compromised host before declaring containment\n- Relying solely on Windows Event Logs without correlating network flow data, missing lateral movement via tools that do not generate Windows events\n- Not establishing a baseline of normal internal authentication patterns, making anomaly detection impossible\n\n## Output Format\n\n```\n## Lateral Movement Investigation Report\n\n**Case ID**: IR-2024-0312\n**Initial Alert**: PsExec on 10.10.20.15 at 02:00 UTC\n**Investigation Period**: 2024-03-15 01:00 to 03:00 UTC\n\n### Attack Timeline\n\n| Time (UTC) | Source | Destination | Technique | Evidence |\n|------------|--------|-------------|-----------|----------|\n| 01:15 | External | 10.10.5.23 | Initial Access (Phishing) | Email log + HTTP download |\n| 01:25 | 10.10.5.23 | Local | Credential Dumping | LSASS access (Sysmon EID 10) |\n| 01:32 | 10.10.5.23 | 10.10.20.15 | Pass-the-Hash (SMB) | EID 4624 Type 3 NTLM |\n| 01:38 | 10.10.5.23 | 10.10.20.16 | PsExec | EID 7045 + Zeek SMB |\n| 01:45 | 10.10.20.16 | 10.10.20.17 | RDP | EID 4624 Type 10 |\n| 02:00 | 10.10.20.17 | 10.10.20.15 | PsExec (triggered alert) | EID 7045 |\n| 02:10 | 10.10.5.23 | 203.0.113.50 | Data Exfiltration | Zeek conn.log 2.3 GB |\n\n### Affected Systems\n- 10.10.5.23 (workstation-045) - Initial compromise\n- 10.10.20.15 (file-server-01) - Data accessed\n- 10.10.20.16 (app-server-02) - Pivoted through\n- 10.10.20.17 (db-server-01) - Final target\n\n### Detection Gaps\n1. Initial phishing email not blocked by email gateway\n2. Credential dumping not detected (no LSASS monitoring)\n3. 30-minute gap between first lateral movement and alert\n```\n---","attachment_filenames":["references/api-reference.md","scripts/agent.py"],"attachments":[{"filename":"references/api-reference.md","content":"# Lateral Movement Detection API Reference\n\n## Windows Event IDs for Lateral Movement\n\n| Event ID | Log | Significance |\n|----------|-----|-------------|\n| 4624 (Type 3) | Security | Network logon (SMB, PsExec) |\n| 4624 (Type 10) | Security | RDP logon |\n| 4625 | Security | Failed logon attempt |\n| 4648 | Security | Explicit credential use (RunAs) |\n| 4672 | Security | Admin privileges assigned |\n| 4768 | Security | Kerberos TGT request |\n| 4769 | Security | Kerberos service ticket |\n| 4776 | Security | NTLM credential validation |\n| 7045 | System | New service installed (PsExec) |\n\n## Zeek Log Files for Lateral Movement\n\n| Log | Content |\n|-----|---------|\n| `conn.log` | All connections (filter internal-to-internal) |\n| `smb_mapping.log` | SMB share access |\n| `smb_files.log` | SMB file operations |\n| `dce_rpc.log` | DCE/RPC calls (PsExec, WMI) |\n| `kerberos.log` | Kerberos ticket operations |\n| `ntlm.log` | NTLM authentication events |\n| `rdp.log` | RDP connection metadata |\n\n## Zeek Script - Lateral Movement Detection\n\n```zeek\nevent connection_established(c: connection) {\n if (Site::is_local_addr(c$id$orig_h) && Site::is_local_addr(c$id$resp_h)) {\n if (c$id$resp_p == 445/tcp || c$id$resp_p == 3389/tcp || c$id$resp_p == 5985/tcp) {\n NOTICE([\n $note=LateralMovement::Suspicious,\n $conn=c,\n $msg=fmt(\"Lateral: %s -> %s:%s\", c$id$orig_h, c$id$resp_h, c$id$resp_p)\n ]);\n }\n }\n}\n```\n\n## Splunk SPL - Lateral Movement Queries\n\n```spl\n# Multiple hosts accessed from single source\nindex=wineventlog EventCode=4624 LogonType=3\n| stats dc(ComputerName) as targets values(ComputerName) as hosts by SourceIP Account_Name\n| where targets > 5\n\n# PsExec detection (service install after network logon)\nindex=wineventlog EventCode=7045 ServiceName=\"PSEXESVC\"\n| table _time ComputerName ServiceName ServiceFileName AccountName\n\n# Pass-the-hash (NTLM Type 3 without prior Type 10)\nindex=wineventlog EventCode=4624 LogonType=3 AuthenticationPackageName=NTLM\n| stats count by SourceIP ComputerName Account_Name\n```\n\n## python-evtx - Parse EVTX Files\n\n```python\nimport Evtx.Evtx as evtx\n\nwith evtx.Evtx(\"Security.evtx\") as log:\n for record in log.records():\n xml = record.xml()\n if \"\u003cEventID>4624\u003c/EventID>\" in xml:\n print(record.timestamp(), xml)\n```\n\n## MITRE ATT&CK Lateral Movement (TA0008)\n\n| Technique | ID | Detection |\n|-----------|-------|-----------|\n| Remote Services: SMB | T1021.002 | Port 445 + 7045 events |\n| Remote Services: RDP | T1021.001 | Port 3389 + 4624 Type 10 |\n| Remote Services: WinRM | T1021.006 | Port 5985/5986 |\n| Lateral Tool Transfer | T1570 | SMB file operations |\n| Pass the Hash | T1550.002 | NTLM Type 3 from workstation |\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":2776,"content_sha256":"69c2c675f704133962b11874506f9df94c718e728d75de01307997e6195dc74a"},{"filename":"scripts/agent.py","content":"#!/usr/bin/env python3\n\"\"\"Lateral movement detection agent using Zeek logs and Windows event analysis.\"\"\"\n\nimport json\nimport os\nimport re\nimport sys\nfrom collections import Counter, defaultdict\nfrom datetime import datetime\n\ntry:\n import Evtx.Evtx as evtx\n HAS_EVTX = True\nexcept ImportError:\n HAS_EVTX = False\n\n\nLATERAL_MOVEMENT_EVENT_IDS = {\n \"4624\": \"Successful Logon\",\n \"4625\": \"Failed Logon\",\n \"4648\": \"Logon with Explicit Credentials\",\n \"4672\": \"Special Privileges Assigned\",\n \"7045\": \"New Service Installed\",\n}\n\nSUSPICIOUS_LOGON_TYPES = {\"3\": \"Network\", \"10\": \"RemoteInteractive (RDP)\"}\n\n\ndef parse_zeek_conn_log(log_path):\n \"\"\"Parse Zeek conn.log for internal lateral movement patterns.\"\"\"\n if not os.path.exists(log_path):\n return {\"error\": f\"Zeek conn.log not found: {log_path}\"}\n\n connections = defaultdict(lambda: {\"count\": 0, \"ports\": Counter(), \"bytes\": 0})\n with open(log_path, \"r\") as f:\n for line in f:\n if line.startswith(\"#\"):\n continue\n fields = line.strip().split(\"\\t\")\n if len(fields) \u003c 10:\n continue\n src_ip = fields[2] if len(fields) > 2 else \"\"\n dst_ip = fields[4] if len(fields) > 4 else \"\"\n dst_port = fields[5] if len(fields) > 5 else \"\"\n resp_bytes = int(fields[9]) if len(fields) > 9 and fields[9] != \"-\" else 0\n\n if src_ip.startswith((\"10.\", \"172.16.\", \"192.168.\")) and dst_ip.startswith((\"10.\", \"172.16.\", \"192.168.\")):\n key = f\"{src_ip}->{dst_ip}\"\n connections[key][\"count\"] += 1\n connections[key][\"ports\"][dst_port] += 1\n connections[key][\"bytes\"] += resp_bytes\n\n lateral_indicators = []\n for pair, info in connections.items():\n smb_count = info[\"ports\"].get(\"445\", 0) + info[\"ports\"].get(\"139\", 0)\n rdp_count = info[\"ports\"].get(\"3389\", 0)\n winrm_count = info[\"ports\"].get(\"5985\", 0) + info[\"ports\"].get(\"5986\", 0)\n psexec_count = info[\"ports\"].get(\"445\", 0)\n\n if smb_count > 0 or rdp_count > 0 or winrm_count > 0:\n src, dst = pair.split(\"->\")\n lateral_indicators.append({\n \"source\": src, \"destination\": dst,\n \"total_connections\": info[\"count\"],\n \"smb_connections\": smb_count,\n \"rdp_connections\": rdp_count,\n \"winrm_connections\": winrm_count,\n \"total_bytes\": info[\"bytes\"],\n \"risk\": \"HIGH\" if smb_count > 10 or rdp_count > 5 else \"MEDIUM\",\n })\n\n lateral_indicators.sort(key=lambda x: x[\"total_connections\"], reverse=True)\n return {\"total_internal_pairs\": len(connections), \"lateral_indicators\": lateral_indicators[:30]}\n\n\ndef parse_zeek_smb_log(log_path):\n \"\"\"Parse Zeek smb_mapping.log for file share access patterns.\"\"\"\n if not os.path.exists(log_path):\n return {\"error\": f\"SMB log not found: {log_path}\"}\n\n mappings = []\n with open(log_path, \"r\") as f:\n for line in f:\n if line.startswith(\"#\"):\n continue\n fields = line.strip().split(\"\\t\")\n if len(fields) >= 6:\n mappings.append({\n \"timestamp\": fields[0],\n \"source\": fields[2] if len(fields) > 2 else \"\",\n \"destination\": fields[4] if len(fields) > 4 else \"\",\n \"share\": fields[5] if len(fields) > 5 else \"\",\n })\n\n share_counts = Counter(m.get(\"share\", \"\") for m in mappings)\n src_counts = Counter(m.get(\"source\", \"\") for m in mappings)\n\n return {\n \"total_mappings\": len(mappings),\n \"top_shares\": share_counts.most_common(10),\n \"top_sources\": src_counts.most_common(10),\n \"recent\": mappings[-20:],\n }\n\n\ndef analyze_windows_auth_logs(evtx_path):\n \"\"\"Analyze Windows Security EVTX for lateral movement indicators.\"\"\"\n if not HAS_EVTX:\n return {\"error\": \"python-evtx not installed (pip install python-evtx)\"}\n if not os.path.exists(evtx_path):\n return {\"error\": f\"EVTX file not found: {evtx_path}\"}\n\n network_logons = []\n failed_logons = []\n explicit_creds = []\n new_services = []\n\n with evtx.Evtx(evtx_path) as log:\n for record in log.records():\n try:\n xml = record.xml()\n for eid, desc in LATERAL_MOVEMENT_EVENT_IDS.items():\n if f\"\u003cEventID>{eid}\u003c/EventID>\" in xml:\n entry = {\n \"event_id\": eid,\n \"description\": desc,\n \"timestamp\": record.timestamp().isoformat(),\n }\n if eid == \"4624\":\n logon_type_match = re.search(r\"\u003cData Name='LogonType'>(\\d+)\u003c/Data>\", xml)\n if logon_type_match and logon_type_match.group(1) in SUSPICIOUS_LOGON_TYPES:\n entry[\"logon_type\"] = logon_type_match.group(1)\n network_logons.append(entry)\n elif eid == \"4625\":\n failed_logons.append(entry)\n elif eid == \"4648\":\n explicit_creds.append(entry)\n elif eid == \"7045\":\n new_services.append(entry)\n break\n except Exception:\n continue\n\n return {\n \"network_logons\": len(network_logons),\n \"failed_logons\": len(failed_logons),\n \"explicit_credential_use\": len(explicit_creds),\n \"new_services_installed\": len(new_services),\n \"recent_network_logons\": network_logons[-20:],\n \"recent_failures\": failed_logons[-20:],\n \"new_services\": new_services[-10:],\n }\n\n\ndef detect_pass_the_hash_pattern(events):\n \"\"\"Detect pass-the-hash indicators from auth events.\"\"\"\n alerts = []\n by_source = defaultdict(list)\n for e in events:\n src = e.get(\"source\", e.get(\"source_ip\", \"\"))\n by_source[src].append(e)\n\n for src, src_events in by_source.items():\n unique_dests = set(e.get(\"destination\", e.get(\"dest_ip\", \"\")) for e in src_events)\n if len(unique_dests) > 5:\n alerts.append({\n \"type\": \"PASS_THE_HASH_CANDIDATE\",\n \"severity\": \"HIGH\",\n \"source\": src,\n \"unique_destinations\": len(unique_dests),\n \"destinations\": list(unique_dests)[:20],\n \"event_count\": len(src_events),\n })\n return alerts\n\n\ndef generate_report(zeek_log_dir=None, evtx_path=None):\n \"\"\"Generate comprehensive lateral movement detection report.\"\"\"\n report = {\"timestamp\": datetime.utcnow().isoformat() + \"Z\"}\n\n if zeek_log_dir:\n conn_log = os.path.join(zeek_log_dir, \"conn.log\")\n smb_log = os.path.join(zeek_log_dir, \"smb_mapping.log\")\n report[\"zeek_connections\"] = parse_zeek_conn_log(conn_log)\n report[\"zeek_smb\"] = parse_zeek_smb_log(smb_log)\n\n if evtx_path:\n report[\"windows_auth\"] = analyze_windows_auth_logs(evtx_path)\n\n return report\n\n\nif __name__ == \"__main__\":\n action = sys.argv[1] if len(sys.argv) > 1 else \"help\"\n if action == \"zeek-conn\" and len(sys.argv) > 2:\n print(json.dumps(parse_zeek_conn_log(sys.argv[2]), indent=2, default=str))\n elif action == \"zeek-smb\" and len(sys.argv) > 2:\n print(json.dumps(parse_zeek_smb_log(sys.argv[2]), indent=2, default=str))\n elif action == \"windows\" and len(sys.argv) > 2:\n print(json.dumps(analyze_windows_auth_logs(sys.argv[2]), indent=2, default=str))\n elif action == \"report\":\n zeek_dir = sys.argv[2] if len(sys.argv) > 2 else None\n evtx_file = sys.argv[3] if len(sys.argv) > 3 else None\n print(json.dumps(generate_report(zeek_dir, evtx_file), indent=2, default=str))\n else:\n print(\"Usage: agent.py [zeek-conn \u003cconn.log>|zeek-smb \u003csmb.log>|windows \u003cSecurity.evtx>|report [zeek_dir] [evtx]]\")\n","content_type":"text/x-python; charset=utf-8","language":"python","size":8074,"content_sha256":"2a0875ddf152a385855034e25c538a5f09a7705cf53fb2493e2bcd865b9f3d31"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Detecting Lateral Movement in Network","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"When to Use","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Monitoring enterprise networks for post-compromise lateral movement patterns (pass-the-hash, RDP hopping, PSExec)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Building SIEM detection rules and alerts for common MITRE ATT&CK lateral movement techniques (T1021, T1570)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Investigating suspected breaches by analyzing authentication patterns and network connections between internal hosts","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Hunting for anomalous east-west traffic patterns that indicate an attacker pivoting through the network","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Validating that network segmentation and access controls effectively limit lateral movement paths","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Do not use","type":"text","marks":[{"type":"strong"}]},{"text":" as a substitute for endpoint detection and response (EDR) tools, for monitoring only north-south traffic while ignoring internal traffic flows, or without baseline knowledge of normal internal communication patterns.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Network security monitoring deployed at internal choke points (Zeek, Suricata, or network TAPs)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"SIEM platform (Splunk, Elastic, Microsoft Sentinel) collecting Windows Security Event Logs, DNS, and flow data","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Windows Event Log forwarding configured for Security events (4624, 4625, 4648, 4672, 4768, 4769)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Baseline of normal internal authentication and connection patterns","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Understanding of MITRE ATT&CK Lateral Movement tactics (TA0008)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Workflow","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 1: Configure Log Collection for Lateral Movement Detection","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Windows Event Logs to collect (via WEF or agent):\n# Security Log:\n# 4624 - Successful logon (Type 3=Network, Type 10=RemoteInteractive)\n# 4625 - Failed logon\n# 4648 - Logon using explicit credentials (RunAs, PsExec)\n# 4672 - Special privileges assigned (admin logon)\n# 4768 - Kerberos TGT request\n# 4769 - Kerberos service ticket request\n# 4776 - NTLM authentication (credential validation)\n# System Log:\n# 7045 - New service installed (PsExec indicator)\n# 7036 - Service started/stopped\n\n# Configure Windows Event Forwarding (WEF) subscription\n# On the collector server (PowerShell):\n# wecutil cs lateral-movement-subscription.xml\n\n# Filebeat configuration for Windows Event Log shipping\ncat > /etc/filebeat/modules.d/security.yml \u003c\u003c 'EOF'\n- module: system\n auth:\n enabled: true\n var.paths: [\"/var/log/auth.log\"]\n syslog:\n enabled: true\n\n- module: zeek\n connection:\n enabled: true\n var.paths: [\"/opt/zeek/logs/current/conn.log\"]\n dns:\n enabled: true\n var.paths: [\"/opt/zeek/logs/current/dns.log\"]\n smb_mapping:\n enabled: true\n var.paths: [\"/opt/zeek/logs/current/smb_mapping.log\"]\n dce_rpc:\n enabled: true\n var.paths: [\"/opt/zeek/logs/current/dce_rpc.log\"]\nEOF\n\n# Zeek configuration for lateral movement detection\n# Enable SMB, DCE-RPC, and Kerberos logging\ncat >> /opt/zeek/share/zeek/site/local.zeek \u003c\u003c 'EOF'\n@load policy/protocols/smb\n@load policy/protocols/conn/known-hosts\n@load policy/protocols/conn/known-services\n@load frameworks/intel/seen\nEOF\n\nsudo zeekctl deploy","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 2: Build Detection Rules for Common Lateral Movement Techniques","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"yaml"},"content":[{"text":"# Splunk SPL queries for lateral movement detection\n\n# 1. Detect PsExec usage (new service creation on remote hosts)\n# index=wineventlog EventCode=7045 ServiceName=\"PSEXESVC\" OR ServiceName=\"*psexec*\"\n# | stats count by ComputerName, ServiceName, ImagePath\n# | where count > 0\n\n# 2. Detect Pass-the-Hash (Type 3 logon with NTLM)\n# index=wineventlog EventCode=4624 LogonType=3 AuthenticationPackageName=\"NTLM\"\n# | where TargetUserName!=\"ANONYMOUS LOGON\" AND TargetUserName!=\"$\"\n# | stats count dc(ComputerName) as unique_hosts by TargetUserName, IpAddress\n# | where unique_hosts > 3\n\n# 3. Detect RDP lateral movement (Type 10 logon from internal IPs)\n# index=wineventlog EventCode=4624 LogonType=10\n# | where cidrmatch(\"10.0.0.0/8\", IpAddress) OR cidrmatch(\"192.168.0.0/16\", IpAddress)\n# | stats count dc(ComputerName) as rdp_hosts by TargetUserName, IpAddress\n# | where rdp_hosts > 2\n\n# Elastic SIEM detection rules (KQL)\n# event.code: \"4624\" and winlog.event_data.LogonType: \"3\"\n# and winlog.event_data.AuthenticationPackageName: \"NTLM\"\n# and not winlog.event_data.TargetUserName: *$\n# and source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Sigma rules for lateral movement detection\n# Install sigma and convert to target SIEM format\npip3 install sigma-cli\n\ncat > lateral_movement_pth.yml \u003c\u003c 'EOF'\ntitle: Pass-the-Hash Lateral Movement Detection\nid: f8d98d6c-7a07-4d74-b064-dd4a3c244528\nstatus: experimental\ndescription: Detects network logon with NTLM authentication to multiple hosts\nlogsource:\n product: windows\n service: security\ndetection:\n selection:\n EventID: 4624\n LogonType: 3\n AuthenticationPackageName: NTLM\n filter:\n TargetUserName|endswith: '

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\n condition: selection and not filter\n timeframe: 15m\n count:\n field: ComputerName\n min: 3\n group-by: TargetUserName\nlevel: high\ntags:\n - attack.lateral_movement\n - attack.t1550.002\nEOF\n\n# Convert Sigma rule to Splunk SPL\nsigma convert -t splunk lateral_movement_pth.yml\n\n# Convert to Elastic query\nsigma convert -t elasticsearch lateral_movement_pth.yml","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 3: Network-Level Detection with Zeek","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Detect SMB lateral movement (admin$ and c$ share access)\ncat /opt/zeek/logs/current/smb_mapping.log | \\\n zeek-cut ts id.orig_h id.resp_h path | \\\n grep -iE \"(admin\\$|c\\$|ipc\\$)\" | \\\n sort -t

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\t' -k2 | head -20\n\n# Detect Kerberos ticket-granting anomalies\ncat /opt/zeek/logs/current/kerberos.log | \\\n zeek-cut ts id.orig_h id.resp_h client service success error_msg | \\\n grep -v \"true\" | head -20\n\n# Custom Zeek script for lateral movement detection\nsudo tee /opt/zeek/share/zeek/site/custom-detections/lateral-movement.zeek \u003c\u003c 'ZEEKEOF'\n@load base/frameworks/notice\n@load base/frameworks/sumstats\n\nmodule LateralMovement;\n\nexport {\n redef enum Notice::Type += {\n SMB_Lateral_Spread,\n RDP_Lateral_Chain\n };\n const smb_host_threshold: count = 5 &redef;\n const smb_time_window: interval = 15min &redef;\n}\n\nevent zeek_init()\n{\n local r1 = SumStats::Reducer(\n $stream=\"lateral.smb\",\n $apply=set(SumStats::UNIQUE)\n );\n\n SumStats::create([\n $name=\"detect-smb-lateral\",\n $epoch=smb_time_window,\n $reducers=set(r1),\n $threshold_val(key: SumStats::Key, result: SumStats::Result) = {\n return result[\"lateral.smb\"]$unique + 0.0;\n },\n $threshold=smb_host_threshold + 0.0,\n $threshold_crossed(key: SumStats::Key, result: SumStats::Result) = {\n NOTICE([\n $note=SMB_Lateral_Spread,\n $msg=fmt(\"Host %s connected to %d SMB hosts in %s\",\n key$str, result[\"lateral.smb\"]$unique, smb_time_window),\n $identifier=key$str\n ]);\n }\n ]);\n}\n\nevent connection_state_remove(c: connection)\n{\n if ( c$id$resp_p == 445/tcp && c$id$resp_h in Site::local_nets )\n {\n SumStats::observe(\"lateral.smb\",\n [$str=cat(c$id$orig_h)],\n [$str=cat(c$id$resp_h)]\n );\n }\n}\nZEEKEOF\n\nsudo zeekctl deploy","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 4: Threat Hunting for Lateral Movement Indicators","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Hunt for authentication anomalies in Windows logs\n# Splunk query: Users authenticating from unusual source hosts\n# index=wineventlog EventCode=4624 LogonType=3\n# | stats values(IpAddress) as source_ips dc(IpAddress) as source_count by TargetUserName\n# | where source_count > 5\n# | sort -source_count\n\n# Hunt for service accounts used interactively\n# index=wineventlog EventCode=4624 (LogonType=2 OR LogonType=10)\n# | where match(TargetUserName, \"^svc-.*\")\n# | table _time ComputerName TargetUserName IpAddress LogonType\n\n# Network flow analysis for lateral movement patterns\n# Look for hosts that suddenly start communicating with many internal hosts\ncat /opt/zeek/logs/current/conn.log | \\\n zeek-cut ts id.orig_h id.resp_h | \\\n awk '{\n key = $2\n targets[key][$3] = 1\n }\n END {\n for (src in targets) {\n count = 0\n for (dst in targets[src]) count++\n if (count > 20) print src, count\n }\n }' | sort -k2 -rn\n\n# Detect credential dumping artifacts (large LSASS reads)\n# Look for connections from hosts that suddenly pivot\ncat /opt/zeek/logs/current/conn.log | \\\n zeek-cut ts id.orig_h id.resp_h id.resp_p orig_bytes | \\\n awk '$4 == 445 && $5 > 10000000' | sort -t

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.