SKILL.md
Detecting Lateral Movement with Splunk
When to Use
- When hunting for adversary movement between compromised systems
- After detecting credential theft to trace subsequent lateral activity
- When investigating unusual authentication patterns across the network
- During incident response to scope the breadth of compromise
- When proactively hunting for TA0008 (Lateral Movement) techniques
Prerequisites
- Splunk Enterprise or Splunk Cloud with Windows event data ingested
- Windows Security Event Logs forwarded (4624, 4625, 4648, 4672, 4768, 4769)
- Sysmon deployed for process creation and network connection data
- Network flow data or firewall logs for SMB/RDP/WinRM correlation
- Active Directory user and group membership reference data
Workflow
- Define Lateral Movement Scope: Identify which lateral movement techniques to hunt (RDP, SMB/Admin Shares, WinRM, PsExec, WMI, DCOM, SSH).
- Query Authentication Events: Use SPL to search for Type 3 (Network) and Type 10 (RemoteInteractive) logons across the environment.
- Build Authentication Graphs: Map source-to-destination authentication relationships to identify unusual connection patterns.
- Detect First-Time Relationships: Identify new source-destination pairs that have not been seen in the historical baseline.
- Correlate with Process Activity: Link authentication events to subsequent process creation on destination hosts.
- Identify Anomalous Patterns: Flag lateral movement to sensitive servers, unusual hours, service account misuse, or rapid multi-host access.
- Report and Contain: Document lateral movement path, affected systems, and coordinate containment response.