Detects attacker lateral movement across networks using Splunk SPL queries on Windows authentication logs, SMB traffic, and remote service abuse. Useful for threat hunting TA0008 in SIEM setups.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 狩猎攻击者在受攻击系统之间的移动时
Detects adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse. For threat hunting TA0008 techniques during incident response.
Detects adversary lateral movement using Splunk SPL queries on Windows authentication logs, SMB traffic, and remote services like RDP, WinRM, PsExec.
Detects lateral movement techniques like Pass-the-Hash, PsExec, WMI execution, RDP transfers, and SMB propagation using SIEM SPL queries on Windows event logs, Sysmon, and network flows. Maps to MITRE ATT&CK TA0008.
Share bugs, ideas, or general feedback.
| 概念 | 描述 |
|---|---|
| T1021 | 远程服务（父技术） |
| T1021.001 | 远程桌面协议（RDP） |
| T1021.002 | SMB/Windows 管理共享 |
| T1021.003 | 分布式 COM（DCOM） |
| T1021.004 | SSH |
| T1021.006 | Windows 远程管理（WinRM） |
| T1570 | 横向工具传输 |
| T1047 | Windows 管理规范（WMI） |
| T1569.002 | 服务执行（PsExec） |
| 登录类型 3 | 网络登录（SMB、WinRM、映射驱动器） |
| 登录类型 10 | 远程交互（RDP） |
| 事件 ID 4624 | 成功登录 |
| 事件 ID 4648 | 显式凭据登录（runas、PsExec） |
| 工具 | 用途 |
|---|---|
| Splunk Enterprise | 日志聚合和 SPL 查询的 SIEM |
| Splunk Enterprise Security | 威胁检测和重要事件 |
| Windows Event Forwarding | 集中化 Windows 日志 |
| Sysmon | 详细的进程和网络遥测 |
| BloodHound | AD 攻击路径分析 |
| PingCastle | AD 安全评估 |
Hunt ID: TH-LATMOV-[DATE]-[SEQ]
Movement Type: [RDP/SMB/WinRM/WMI/DCOM/PsExec]
Source Host: [主机名/IP]
Destination Host: [主机名/IP]
Account Used: [用户名]
Logon Type: [3/10/其他]
First Seen: [时间戳]
Event Count: [事件数]
Risk Level: [Critical/High/Medium/Low]
Lateral Movement Path: [A -> B -> C -> D]