skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-lateral-movement-in-network

Detect lateral movement in enterprise networks using Zeek logs, Windows events, and SIEM correlation rules.

954|172|Updated Mar 13, 2026
Search Tags:#threat detection#threat hunting#lateral movement#pass-the-hash#siem#sigma rules#zeek
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-lateral-movement-in-network
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-lateral-movement-in-network
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/detecting-lateral-movement-in-network
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-lateral-movement-in-network

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams struggle to spot attackers moving between internal systems after an initial compromise, because techniques like pass-the-hash, PsExec, and RDP hopping blend into normal east-west traffic. This Skill provides a complete detection workflow that correlates authentication logs, network flows, and service creation events to surface lateral movement before it spreads.

Core Features & Use Cases

  • Log Collection Setup: Configures Windows Event Forwarding, Filebeat, and Zeek to capture the exact events (4624, 4625, 4648, 7045, 4768/4769) needed for lateral movement detection.
  • Detection Rule Engineering: Provides ready-to-use Splunk SPL, Elastic KQL, and Sigma rules for pass-the-hash, PsExec, and RDP lateral movement mapped to MITRE ATT&CK techniques.
  • Network-Level Analysis: Includes Zeek queries and a custom Zeek script that alert on SMB fan-out, admin$ share access, WMI activity, and Kerberos anomalies between internal hosts.
  • Use Case: A SOC analyst receives a PsExec alert on a file server at 2 AM and uses this workflow to trace the full attack chain across eight servers, build a timeline, and contain every compromised host.

Quick Start

Ask the AI to build detection rules and Zeek queries for identifying pass-the-hash and PsExec lateral movement across your internal network using your existing Windows event logs and SIEM platform.

Frequently Asked Questions about detecting-lateral-movement-in-network

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect pass-the-hash attacks in Windows event logs?▼

Pass-the-hash detection relies on Event ID 4624 with LogonType 3 and NTLM authentication package, excluding machine accounts. Alert when a single account authenticates to more than three hosts within 15 minutes, which indicates hash reuse across systems.

How to detect PsExec lateral movement with SIEM rules?▼

PsExec detection uses Windows Event ID 7045 for new service creation, specifically services named PSEXESVC or similar patterns. Correlate with Zeek SMB logs showing admin$ share access and DCE-RPC activity to confirm remote service execution.

What Zeek logs are useful for lateral movement detection?▼

Zeek's smb_mapping.log reveals admin$ and c$ share access, conn.log shows SMB fan-out on port 445, dce_rpc.log exposes WMI activity, and kerberos.log captures ticket anomalies. A custom SumStats script can alert when one host connects to five or more SMB hosts in 15 minutes.

Can Sigma rules be converted to Splunk or Elastic queries?▼

Yes, Sigma rules are vendor-agnostic and convert to multiple SIEM formats using sigma-cli. Run sigma convert with the splunk or elasticsearch target to generate platform-specific queries from a single lateral movement detection rule.

What are the limitations of network-based lateral movement detection?▼

Network detection cannot replace EDR tooling and may miss lateral movement that generates no Windows events or uses encrypted channels. It also requires a baseline of normal internal authentication patterns, without which anomaly detection produces excessive false positives.

Related Skills

Explore More Software Engineering Skills→
BagelHoleBagelHole
46

audit-logging

Implement centralized audit logging with Fluentd and Elasticsearch.

Community
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-docker-container-forensics

Analyze Docker containers to detect compromises and collect forensic evidence.

Community
Advanced
AeonDaveAeonDave
15

bloodhound

Map Active Directory attack paths and identify privilege escalation opportunities.

Community
Advanced
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced