Detects lateral movement techniques like Pass-the-Hash, PsExec, WMI execution, RDP transfers, and SMB propagation using SIEM SPL queries on Windows event logs, Sysmon, and network flows. Maps to MITRE ATT&CK TA0008.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
以下情况使用本技能：
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB spreading using SIEM queries on Windows event logs, Sysmon, and network flows. Maps to MITRE ATT&CK TA0008.
Detects lateral movement techniques like Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB spreading using SIEM queries on Windows event logs, Sysmon, and network flows, mapped to MITRE ATT&CK TA0008.
Detects attacker lateral movement across networks using Splunk SPL queries on Windows authentication logs, SMB traffic, and remote service abuse. Useful for threat hunting TA0008 in SIEM setups.
Share bugs, ideas, or general feedback.
以下情况使用本技能：
不适用于检测初始访问或外部攻击——横向移动检测专注于内部主机到主机的转移活动。
哈希传递（Pass-the-Hash）检测（EventCode 4624 含 NTLM）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
AuthenticationPackageName="NTLM"
| where TargetUserName!="ANONYMOUS LOGON" AND TargetUserName!="$"
| stats count, dc(ComputerName) AS unique_targets, values(ComputerName) AS targets
by src_ip, TargetUserName
| where unique_targets > 3
| eval alert = "可能的哈希传递：NTLM 网络登录到 ".unique_targets." 台主机"
| sort - unique_targets
| table src_ip, TargetUserName, unique_targets, count, targets, alert
越过哈希（Overpass-the-Hash）检测（使用 RC4 的 Kerberos）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
TicketEncryptionType="0x17"
| where ServiceName!="krbtgt" AND ServiceName!="$"
| stats count, dc(ServiceName) AS unique_services by src_ip, TargetUserName
| where count > 5
| eval alert = "可能的越过哈希：来自 ".src_ip." 的 RC4 Kerberos 票据"
| table _time, src_ip, TargetUserName, unique_services, count, alert
黄金票/白银票检测（T1558）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
| where TicketOptions="0x40810000" OR TicketOptions="0x40800000"
| eval ticket_lifetime = TicketExpireTime - TicketIssueTime
| where ticket_lifetime > 36000 --- >10 小时（异常）
| stats count by src_ip, TargetUserName, ServiceName, TicketEncryptionType, TicketOptions
| eval alert = "可能的黄金/白银票：异常票据属性"
PsExec 检测（T1021.002）：
--- 通过 Sysmon 进程创建
index=sysmon EventCode=1
(Image="*\\psexec.exe" OR Image="*\\psexesvc.exe"
OR OriginalFileName="psexec.c" OR OriginalFileName="psexesvc.exe"
OR ParentImage="*\\psexesvc.exe")
| table _time, Computer, User, ParentImage, Image, CommandLine, Hashes
--- 通过命名管道创建（Sysmon EventCode 17）
index=sysmon EventCode=17
PipeName IN ("\\PSEXESVC*", "\\RemCom*", "\\csexec*")
| table _time, Computer, User, Image, PipeName
--- 通过 Windows 服务创建（EventCode 7045）
index=wineventlog sourcetype="WinEventLog:System" EventCode=7045
ServiceName="PSEXESVC" OR ServiceFileName="*PSEXESVC*"
| table _time, Computer, ServiceName, ServiceFileName, AccountName
WMI 远程执行（T1047）：
index=sysmon EventCode=1
(Image="*\\wmic.exe" AND CommandLine="*/node:*")
OR (ParentImage="*\\WmiPrvSE.exe" AND Image IN ("*\\cmd.exe", "*\\powershell.exe"))
| eval execution_type = case(
match(Image, "wmic"), "WMI 命令行",
match(ParentImage, "WmiPrvSE"), "WMI 提供程序主机（远程执行）"
)
| table _time, Computer, User, execution_type, ParentImage, Image, CommandLine
WinRM/PowerShell 远程（T1021.006）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624
Logon_Type=3 AuthenticationPackageName="Kerberos"
| where ProcessName="*\\wsmprovhost.exe" OR ProcessName="*\\powershell.exe"
| stats count, dc(ComputerName) AS unique_targets by src_ip, TargetUserName
| where unique_targets > 2
| eval alert = "PowerShell 远程连接到来自 ".src_ip." 的 ".unique_targets." 台主机"
--- Sysmon 变体
index=sysmon EventCode=1
ParentImage="*\\wsmprovhost.exe"
Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\csc.exe")
| table _time, Computer, User, Image, CommandLine
RDP 横向移动（T1021.001）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=10
| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations,
earliest(_time) AS first_rdp, latest(_time) AS last_rdp
by src_ip, TargetUserName
| where rdp_targets > 2
| eval duration_hours = round((last_rdp - first_rdp) / 3600, 1)
| eval alert = TargetUserName." 在 ".duration_hours." 小时内 RDP 连接到 ".rdp_targets." 台主机"
| sort - rdp_targets
异常 SMB 流量模式：
index=firewall OR index=zeek sourcetype IN ("pan:traffic", "bro:conn:json")
dest_port=445 action=allowed
| where src_ip!=dest_ip
| stats count AS smb_sessions, dc(dest_ip) AS unique_targets,
sum(bytes_out) AS total_bytes
by src_ip
| where unique_targets > 10
| eval alert = case(
unique_targets > 50, "严重：来自 ".src_ip." 的大量 SMB 枚举",
unique_targets > 20, "高：显著的 SMB 横向移动",
unique_targets > 10, "中：SMB 连接次数偏高"
)
| sort - unique_targets
管理共享访问（C$、ADMIN$）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=5140
ShareName IN ("\\\\*\\C$", "\\\\*\\ADMIN$", "\\\\*\\IPC$")
| where SubjectUserName!="SYSTEM" AND SubjectUserName!="$"
| stats count, dc(ComputerName) AS unique_hosts by SubjectUserName, ShareName, src_ip
| where unique_hosts > 3
| eval alert = SubjectUserName." 访问了 ".unique_hosts." 台主机的管理共享"
| sort - unique_hosts
可视化攻击路径：
--- 构建认证事件的源->目标图
index=wineventlog EventCode=4624 Logon_Type IN (3, 10)
earliest=-24h
| stats count AS connections, latest(_time) AS last_connection
by src_ip, ComputerName, TargetUserName, Logon_Type
| eval edge = src_ip." -> ".ComputerName." (用户：".TargetUserName."，类型：".Logon_Type.")"
| sort - connections
| table edge, connections, last_connection
--- 网络流关联
index=netflow earliest=-24h
dest_port IN (445, 135, 3389, 5985, 5986)
| stats sum(bytes) AS total_bytes, count AS flow_count,
dc(dest_ip) AS targets by src_ip, dest_port
| where targets > 5
| eval service = case(
dest_port=445, "SMB",
dest_port=135, "RPC/WMI",
dest_port=3389, "RDP",
dest_port IN (5985, 5986), "WinRM"
)
| sort - targets
| table src_ip, service, targets, flow_count, total_bytes
DCOM 远程执行（T1021.003）：
index=sysmon EventCode=1
ParentImage IN ("*\\mmc.exe", "*\\excel.exe", "*\\outlook.exe")
Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\mshta.exe")
| where ParentCommandLine="*-Embedding*"
| eval alert = "基于 DCOM 的横向移动：".ParentImage." 生成了 ".Image
| table _time, Computer, User, ParentImage, Image, CommandLine, alert
远程计划任务创建（T1053.005）：
index=wineventlog EventCode=4698
| where SubjectUserName!="SYSTEM"
| eval task_xml = TaskContent
| search task_xml="*http*" OR task_xml="*powershell*" OR task_xml="*cmd*" OR task_xml="*\\Temp\\*"
| table _time, Computer, SubjectUserName, TaskName, task_xml
构建端到端攻击链检测：
--- 检测完整横向移动序列
index=wineventlog OR index=sysmon
(EventCode=4625 OR EventCode=4624 OR EventCode=1 OR EventCode=4698 OR EventCode=5140)
| eval phase = case(
EventCode=4625, "1-侦察/暴力破解",
EventCode=4624 AND Logon_Type=3, "2-横向移动",
EventCode=5140 AND match(ShareName, "C\$|ADMIN\$"), "3-管理共享访问",
EventCode=1 AND match(ParentImage, "psexesvc|WmiPrvSE|wsmprovhost"), "4-远程执行",
EventCode=4698, "5-持久化（计划任务）",
1=1, "other"
)
| where phase!="other"
| stats count by phase, src_ip, ComputerName, TargetUserName
| sort phase, _time
| table phase, src_ip, ComputerName, TargetUserName, count
| 术语 | 定义 |
|---|---|
| 横向移动（Lateral Movement） | 入侵后攻击者在系统间横向转移以到达目标的技术 |
| 哈希传递（Pass-the-Hash） | 使用盗取的 NTLM 哈希进行认证，无需知道明文密码 |
| 票据传递（Pass-the-Ticket） | 使用盗取的 Kerberos TGT/TGS 票据在域内进行认证 |
| PsExec | Sysinternals 工具（及攻击技术），通过 SMB 和命名管道进行远程进程执行 |
| WMI 执行（WMI Execution） | 通过 DCOM 或 WinRM 使用 Windows 管理规范（WMI）进行远程命令执行 |
| 管理共享（Admin Share） | 默认 Windows 管理共享（C$、ADMIN$、IPC$），用于远程系统管理 |
横向移动检测报告
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
时段： 2024-03-15 14:00 至 18:00 UTC
来源： 192.168.1.105（WORKSTATION-042）
移动路径：
14:23 192.168.1.105 → 10.0.5.20（DC-PRIMARY） — 通过 NTLM Type 3 哈希传递
14:25 10.0.5.20 → 10.0.5.21（DC-BACKUP） — Kerberos 票据复用
14:28 10.0.5.20 → 10.0.10.15（FILESERVER-01） — PsExec 服务创建
14:32 10.0.10.15 → 10.0.10.20（DB-PRIMARY） — WMI 远程执行
14:35 10.0.10.20 → 10.0.10.25（DB-BACKUP） — SMB 管理共享访问
检测到的技术：
T1550.002 — 哈希传递（NTLM 认证到 DC）
T1021.002 — PsExec（远程服务安装）
T1047 — WMI 执行（WmiPrvSE 子进程）
T1021.002 — SMB 管理共享（DB-BACKUP 上的 C$ 访问）
受影响系统： 跨 2 个网络分段的 5 台主机
用户账号： admin_compromised（域管理员）
遏制措施： 5 台主机在 14:45 UTC 已隔离