detecting-lateral-movement-with-splunk skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Detect adversary lateral movement across networks using Splunk SPL queries Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/detecting-lateral-movement-with-splunk/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-lateral-movement-with-splunk, or copy the skill folder into ~/.claude/skills/detecting-lateral-movement-with-splunk/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-splunk/SKILL.md

SKILL.md (verbatim)

name: detecting-lateral-movement-with-splunk
description: Detect adversary lateral movement across networks using Splunk SPL queries
  against Windows authentication logs, SMB traffic, and remote service (WMI/PsExec/RDP)
  abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating
  suspected pivoting between hosts during an incident, with Splunk as the SIEM.
domain: cybersecurity
subdomain: threat-hunting
tags:
- threat-hunting
- mitre-attack
- lateral-movement
- splunk
- siem
- proactive-detection
- ta0008
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Application Protocol Command Analysis
- Network Isolation
- Network Traffic Analysis
- Client-server Payload Profiling
- Network Traffic Community Deviation
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1046
- T1057
- T1082
- T1083
- T1021

Detecting Lateral Movement with Splunk

When to Use

  • When hunting for adversary movement between compromised systems
  • After detecting credential theft to trace subsequent lateral activity
  • When investigating unusual authentication patterns across the network
  • During incident response to scope the breadth of compromise
  • When proactively hunting for TA0008 (Lateral Movement) techniques

Prerequisites

  • Splunk Enterprise or Splunk Cloud with Windows event data ingested
  • Windows Security Event Logs forwarded (4624, 4625, 4648, 4672, 4768, 4769)
  • Sysmon deployed for process creation and network connection data
  • Network flow data or firewall logs for SMB/RDP/WinRM correlation
  • Active Directory user and group membership reference data

Workflow

  1. Define Lateral Movement Scope: Identify which lateral movement techniques to hunt (RDP, SMB/Admin Shares, WinRM, PsExec, WMI, DCOM, SSH).
  2. Query Authentication Events: Use SPL to search for Type 3 (Network) and Type 10 (RemoteInteractive) logons across the environment.
  3. Build Authentication Graphs: Map source-to-destination authentication relationships to identify unusual connection patterns.
  4. Detect First-Time Relationships: Identify new source-destination pairs that have not been seen in the historical baseline.
  5. Correlate with Process Activity: Link authentication events to subsequent process creation on destination hosts.
  6. Identify Anomalous Patterns: Flag lateral movement to sensitive servers, unusual hours, service account misuse, or rapid multi-host access.
  7. Report and Contain: Document lateral movement path, affected systems, and coordinate containment response.

Key Concepts

Concept Description
T1021 Remote Services (parent technique)
T1021.001 Remote Desktop Protocol (RDP)
T1021.002 SMB/Windows Admin Shares
T1021.003 Distributed COM (DCOM)
T1021.004 SSH
T1021.006 Windows Remote Management (WinRM)
T1570 Lateral Tool Transfer
T1047 Windows Management Instrumentation
T1569.002 Service Execution (PsExec)
Logon Type 3 Network logon (SMB, WinRM, mapped drives)
Logon Type 10 Remote Interactive (RDP)
Event ID 4624 Successful logon
Event ID 4648 Explicit credential logon (runas, PsExec)

Tools & Systems

Tool Purpose
Splunk Enterprise SIEM for log aggregation and SPL queries
Splunk Enterprise Security Threat detection and notable events
Windows Event Forwarding Centralize Windows logs
Sysmon Detailed process and network telemetry
BloodHound AD attack path analysis
PingCastle AD security assessment

Common Scenarios

  1. PsExec Lateral Movement: Adversary uses PsExec to execute commands on remote systems via SMB, generating Type 3 logon with ADMIN$ share access.
  2. RDP Pivoting: Attacker RDPs to internal systems using stolen credentials, creating Type 10 logon events.
  3. WMI Remote Execution: Adversary uses WMIC process call create to spawn processes on remote hosts.
  4. WinRM PowerShell Remoting: Attacker uses Enter-PSSession or Invoke-Command to execute code on remote systems.
  5. Pass-the-Hash via SMB: Compromised NTLM hashes used to authenticate to remote systems without knowing the plaintext password.

Output Format

Hunt ID: TH-LATMOV-[DATE]-[SEQ]
Movement Type: [RDP/SMB/WinRM/WMI/DCOM/PsExec]
Source Host: [Hostname/IP]
Destination Host: [Hostname/IP]
Account Used: [Username]
Logon Type: [3/10/other]
First Seen: [Timestamp]
Event Count: [Number of events]
Risk Level: [Critical/High/Medium/Low]
Lateral Movement Path: [A -> B -> C -> D]

Other files in this skill

assets/template.md (verbatim)

Lateral Movement Hunt Template

Hunt Metadata

Field Value
Hunt ID TH-LATMOV-YYYY-MM-DD-NNN
Analyst
Date
Status [ ] In Progress / [ ] Complete

Hypothesis

[e.g., "Adversaries are moving laterally via SMB admin shares using compromised domain admin credentials."]

Techniques Investigated

  • T1021.001 - RDP
  • T1021.002 - SMB/Admin Shares
  • T1021.006 - WinRM
  • T1047 - WMI
  • T1569.002 - PsExec/Service Execution
  • T1550.002 - Pass the Hash
  • T1570 - Lateral Tool Transfer

Lateral Movement Path Map

[Source A] --RDP--> [Host B] --SMB--> [Host C] --WMI--> [Host D]
     |                                    |
     +--PsExec--> [Host E]               +--WinRM--> [Server F]

Findings

# Source Destination Account Method Logon Type Time Risk
1

Affected Accounts

Account Type Hosts Accessed Movement Method

Recommendations

  1. Containment: [Isolate systems, disable accounts]
  2. Credential Reset: [Scope of password resets needed]
  3. Detection: [New rules for identified patterns]

references/api-reference.md (verbatim)

API Reference: Detecting Lateral Movement with Splunk

Key Lateral Movement Techniques

Technique MITRE ID Event Source
Pass-the-Hash T1550.002 Event 4624 Logon_Type=3 NTLM
PSExec T1569.002 Sysmon Event 1 (PSEXESVC.exe)
WMI Remote Exec T1047 Sysmon Event 1 (wmiprvse.exe)
RDP Pivoting T1021.001 Event 4624 Logon_Type=10
SMB/Admin Share T1021.002 Network logs dest_port=445
WinRM T1021.006 Sysmon Event 1 (wsmprovhost.exe)

Splunk SPL Syntax

# Pass-the-Hash detection
index=wineventlog EventCode=4624 Logon_Type=3
| where Authentication_Package="NTLM"
| stats dc(Computer) as targets by Source_Network_Address
| where targets > 3

# PSExec detection
index=sysmon EventCode=1
| where ParentImage="*\\services.exe" AND Image="*\\PSEXESVC.exe"

splunklib Python SDK

import splunklib.client as client
import splunklib.results as results

service = client.connect(host="splunk", port=8089, token="...")
job = service.jobs.create("search index=wineventlog EventCode=4624")
for result in results.JSONResultsReader(job.results(output_mode="json")):
    print(result)

Windows Logon Types

Type Description
2 Interactive (console)
3 Network (SMB, PSExec)
7 Unlock
10 RemoteInteractive (RDP)

CLI Usage

python agent.py --generate-queries
python agent.py --generate-queries --techniques pass_the_hash psexec_execution
python agent.py --parse-results splunk_output.json

references/standards.md (verbatim)

Standards and References - Lateral Movement Detection with Splunk

MITRE ATT&CK Lateral Movement (TA0008)

Technique Name Event Indicators
T1021.001 Remote Desktop Protocol Logon Type 10, RDP certificate events
T1021.002 SMB/Windows Admin Shares Logon Type 3, ADMIN$/C$/IPC$ access
T1021.003 Distributed COM Logon Type 3, DCOM process creation
T1021.004 SSH OpenSSH authentication events
T1021.006 Windows Remote Management WinRM/WSMan logon events
T1047 Windows Management Instrumentation WMI remote process creation
T1569.002 Service Execution PsExec service install + Type 3 logon
T1570 Lateral Tool Transfer File copy over SMB/RDP
T1550.002 Pass the Hash Type 3 logon with NTLM authentication
T1550.003 Pass the Ticket Kerberos TGS without preceding TGT

Windows Logon Types Reference

Type Name Description
2 Interactive Local console logon
3 Network SMB, mapped drives, WinRM
4 Batch Scheduled task execution
5 Service Service startup
7 Unlock Workstation unlock
8 NetworkCleartext IIS basic auth
9 NewCredentials RunAs /netonly
10 RemoteInteractive RDP, Terminal Services
11 CachedInteractive Cached domain logon

Key Windows Event IDs for Lateral Movement

Event ID Source Description
4624 Security Successful account logon
4625 Security Failed account logon
4648 Security Logon with explicit credentials
4672 Security Special privileges assigned (admin logon)
4768 Security Kerberos TGT requested
4769 Security Kerberos TGS requested
4776 Security NTLM credential validation
5140 Security Network share accessed
5145 Security Network share object access check
7045 System New service installed
1 Sysmon Process creation
3 Sysmon Network connection

Splunk Data Model References

  • Authentication data model for login events
  • Network_Traffic data model for connection data
  • Endpoint.Processes for process creation events
  • Change.Endpoint_Changes for service installations

Authentication Protocol Indicators

Protocol Lateral Movement Event Indicators
NTLM Pass-the-Hash Event 4776, NtLmSsp package
Kerberos Pass-the-Ticket Event 4768/4769, ticket anomalies
CredSSP RDP Event 4624 Type 10
WSMan WinRM Event 4624 Type 3, WSMan source

references/workflows.md (verbatim)

Detailed Hunting Workflow - Lateral Movement with Splunk

Phase 1: Network Logon Analysis

Step 1.1 - Type 3 Network Logons (SMB, WinRM)

index=wineventlog EventCode=4624 Logon_Type=3
| where NOT match(Account_Name, "(?i)(SYSTEM|ANONYMOUS|\\$)")
| stats count dc(Computer) as unique_destinations values(Computer) as destinations by Account_Name Source_Network_Address
| where unique_destinations > 3
| sort -unique_destinations

Step 1.2 - Type 10 RDP Logons

index=wineventlog EventCode=4624 Logon_Type=10
| stats count by Account_Name Source_Network_Address Computer
| lookup dnslookup clientip as Source_Network_Address OUTPUT clienthost as src_hostname
| table Account_Name src_hostname Source_Network_Address Computer count
| sort -count

Step 1.3 - Explicit Credential Logons (PsExec, RunAs)

index=wineventlog EventCode=4648
| where NOT match(Target_Server_Name, "(?i)(localhost|\\$)")
| stats count values(Target_Server_Name) as targets by Account_Name Process_Name Computer
| sort -count

Phase 2: Admin Share Access Detection

Step 2.1 - ADMIN$ and C$ Share Access

index=wineventlog EventCode=5140
| where Share_Name IN ("\\\\*\\ADMIN$", "\\\\*\\C$", "\\\\*\\IPC$")
| where NOT match(Account_Name, "(?i)(\\$|SYSTEM)")
| stats count values(Share_Name) as shares by Account_Name Source_Address Computer
| sort -count

Step 2.2 - SMB File Operations on Admin Shares

index=wineventlog EventCode=5145
| where match(Share_Name, "(?i)(ADMIN\\$|C\\$)")
| where match(Relative_Target_Name, "(?i)(\\.exe|\\.dll|\\.ps1|\\.bat|\\.cmd)")
| stats count by Account_Name Source_Address Share_Name Relative_Target_Name Computer

Phase 3: Service-Based Lateral Movement

Step 3.1 - PsExec Service Installation

index=wineventlog EventCode=7045
| where match(Service_File_Name, "(?i)(psexec|PSEXESVC|cmd\.exe|powershell)")
| table _time Computer Service_Name Service_File_Name Service_Account

Step 3.2 - Remote Service Creation Correlation

index=wineventlog EventCode=7045
| eval is_suspicious=if(match(Service_File_Name, "(?i)(temp|appdata|cmd|powershell)"), 1, 0)
| where is_suspicious=1
| join Computer [
    search index=wineventlog EventCode=4624 Logon_Type=3
    | rename Computer as Computer, Source_Network_Address as lateral_src
]
| table _time Computer Service_Name Service_File_Name lateral_src

Phase 4: WMI and DCOM Lateral Movement

Step 4.1 - Remote WMI Execution

index=sysmon EventCode=1
| where match(ParentImage, "(?i)WmiPrvSE\.exe") AND NOT match(Image, "(?i)(WmiApSrv|scrcons)")
| table _time Computer User ParentImage Image CommandLine

Step 4.2 - DCOM Lateral Movement

index=sysmon EventCode=1
| where match(ParentImage, "(?i)(mmc\.exe|excel\.exe|outlook\.exe)")
| where match(Image, "(?i)(cmd\.exe|powershell\.exe|mshta\.exe)")
| table _time Computer User ParentImage Image CommandLine

Phase 5: Authentication Graph Analysis

Step 5.1 - Build Lateral Movement Graph

index=wineventlog EventCode=4624 Logon_Type IN (3, 10)
| where NOT match(Account_Name, "(?i)(\\$|SYSTEM|ANONYMOUS)")
| eval connection=Source_Network_Address."->".Computer
| stats count first(_time) as first_seen last(_time) as last_seen by connection Account_Name
| sort -count

Step 5.2 - First-Time Source-Destination Pairs

index=wineventlog EventCode=4624 Logon_Type IN (3, 10) earliest=-1d
| where NOT match(Account_Name, "(?i)(\\$|SYSTEM)")
| eval pair=Account_Name.":".Source_Network_Address."->".Computer
| search NOT [
    | search index=wineventlog EventCode=4624 Logon_Type IN (3, 10) earliest=-30d latest=-1d
    | eval pair=Account_Name.":".Source_Network_Address."->".Computer
    | dedup pair
    | fields pair
]
| stats count by pair
| sort -count

Phase 6: Anomaly Detection

Step 6.1 - Velocity Anomaly (Rapid Multi-Host Access)

index=wineventlog EventCode=4624 Logon_Type=3
| where NOT match(Account_Name, "(?i)(\\$|SYSTEM)")
| bin _time span=10m
| stats dc(Computer) as hosts_accessed values(Computer) as destinations by _time Account_Name Source_Network_Address
| where hosts_accessed > 5
| sort -hosts_accessed

Step 6.2 - Off-Hours Lateral Movement

index=wineventlog EventCode=4624 Logon_Type IN (3, 10)
| where NOT match(Account_Name, "(?i)(\\$|SYSTEM)")
| eval hour=strftime(_time, "%H")
| where hour < 6 OR hour > 22
| stats count by Account_Name Source_Network_Address Computer hour
| sort -count

Step 6.3 - Service Account Lateral Movement

index=wineventlog EventCode=4624 Logon_Type=10
| where match(Account_Name, "(?i)(svc_|service|admin)")
| stats count by Account_Name Source_Network_Address Computer
| sort -count

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.