skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-lateral-movement-with-splunk

Detect adversary lateral movement using Splunk SPL queries against Windows authentication and Sysmon logs.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#lateral movement#siem#splunk#mitre attack#windows event logs
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-lateral-movement-with-splunk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-lateral-movement-with-splunk
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-lateral-movement-with-splunk
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-lateral-movement-with-splunk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams struggle to spot attackers moving between compromised systems because lateral movement hides inside normal authentication traffic. This Skill provides structured Splunk SPL hunting workflows that surface RDP pivoting, PsExec execution, WMI abuse, WinRM remoting, and Pass-the-Hash activity from Windows event logs.

Core Features & Use Cases

  • Authentication Graph Analysis: Map source-to-destination logon relationships using Event IDs 4624, 4648, and Sysmon data to find first-time or anomalous connections.
  • Technique-Specific Detection: Hunt MITRE ATT&CK techniques T1021.001 through T1021.006, T1047, T1569.002, and T1570 with concrete logon-type and process-correlation logic.
  • False-Positive Guidance: Built-in tuning advice for vulnerability scanners, SCCM, and admin jump hosts, plus validation steps to confirm detections fire.
  • Use Case: After detecting credential theft on a workstation, run the hunt workflow to trace every subsequent Type 3 and Type 10 logon from that host, correlate with wmiprvse.exe or PSEXESVC artifacts, and produce a scoped lateral movement report for containment.

Quick Start

Ask the AI to hunt for lateral movement in your Splunk environment by analyzing Windows Security Event IDs 4624 and 4648 for unusual source-to-destination authentication patterns.

Frequently Asked Questions about detecting-lateral-movement-with-splunk

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect lateral movement with Splunk?▼

Search Windows Security Event ID 4624 for Type 3 (network) and Type 10 (RemoteInteractive) logons, then build source-to-destination authentication graphs. Flag first-time relationships, unusual hours, and rapid multi-host access, and correlate logons with process creation events like wmiprvse.exe or PSEXESVC.

Which Windows Event IDs indicate lateral movement?▼

Event ID 4624 with Logon Type 3 or 10 indicates remote authentication, 4648 shows explicit credential use such as PsExec or runas, and 4768/4769 cover Kerberos ticket activity. Sysmon Event ID 1 and service installation Event ID 7045 reveal execution on destination hosts.

How to detect Pass-the-Hash attacks in Splunk?▼

Pass-the-Hash appears as Event ID 4624 Type 3 with AuthenticationPackageName set to NTLM and LogonProcessName seclogo on systems that should use Kerberos. It does not generate 4648 events, so queries relying only on explicit credential logons will miss it.

What logs are required for lateral movement detection in Splunk?▼

You need Windows Security Event Logs (4624, 4625, 4648, 4672, 4768, 4769) forwarded from all endpoints, Sysmon for process and network telemetry, and network flow or firewall logs for SMB, RDP, and WinRM correlation. Coverage gaps on member servers and workstations are the most common blind spot.

Why does lateral movement detection generate false positives?▼

Vulnerability scanners, SCCM, and admin jump hosts authenticate broadly by design, triggering fan-out alerts. Allowlist their source IPs and service accounts, and expect first-time source-destination detection to be noisy until enough historical baseline accrues.

How do I validate that lateral movement detection rules work?▼

Run PsExec and Enter-PSSession from a test machine against a target host, then confirm your queries return the expected 4624 Type 3 logon, 7045 service installation, or wsmprovhost.exe process events. This proves both log ingestion and detection logic are functioning.

Related Skills

Explore More Software Engineering Skills→
AxxxxxxaaannAxxxxxxaaann

analyzing-windows-event-logs-in-splunk

Analyze Windows event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Community
Advanced
UnitOneAIUnitOneAI
44

containment

Generate NIST SP 800-61 Rev 2-aligned containment plans with MITRE ATT&CK-mapped countermeasures.

Official
Intermediate
dreadnodedreadnode
11

bloodhound

Analyze Active Directory attack paths via BloodHound and Neo4j queries.

Official
Intermediate
GhostPWNGhostPWN
4

Network Security & Traffic Analysis

Analyze PCAP files and firewall configurations to generate Suricata, Snort, and Zeek detection rules.

Official
Advanced