skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

hunt-lateral-movement

Detect lateral movement indicators via PsExec and WMI across enterprise endpoints.

120|34|Updated May 9, 2025
Search Tags:#incident response#network analysis#threat hunting#lateral movement#security operations#psexec#wmi
One-click install
npx skills add https://github.com/dandye/ai-runbooks --skill hunt-lateral-movement
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-lateral-movement
Source: https://github.com/dandye/ai-runbooks/tree/main/skills/hunt-lateral-movement
Command: npx skills add https://github.com/dandye/ai-runbooks --skill hunt-lateral-movement

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Hunts for lateral movement indicators across a network using PsExec and WMI to identify unauthorized remote execution, service installations, and suspicious network activity.

Core Features & Use Cases

  • Proactive lateral-movement hunting using known techniques (PsExec, WMI, and remote execution indicators).
  • Correlates host processes, command lines, and network activity to surface potential attacker movements.
  • Use case: Security teams proactively hunt enterprise endpoints to detect attackers moving laterally before escalation.

Quick Start

Run a guided lateral-movement hunt against your environment to surface PsExec and WMI signals.

Frequently Asked Questions about hunt-lateral-movement

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect lateral movement using PsExec and WMI during incident response?▼

To detect lateral movement using PsExec and WMI, you hunt across enterprise endpoints for unauthorized remote execution, service installations, and suspicious network correlations. This identifies attacker movements before escalation.

What is the best way to hunt for unauthorized remote execution on enterprise endpoints?▼

The best way to hunt for unauthorized remote execution is to correlate host processes, command lines, and network activity. This surfaces potential attacker movements using known techniques like PsExec and WMI.

Can I use this for proactive threat hunting before an incident occurs?▼

Yes, you can use this for proactive threat hunting. Security teams hunt enterprise endpoints to detect attackers moving laterally via PsExec and WMI signals before an incident escalates.

How do I scope lateral movement hunts to a specific time frame?▼

You scope lateral movement hunts by inputting TIME_FRAME_HOURS. The hunt then outputs FINDINGS, DETECTED_TECHNIQUES, and AFFECTED_HOSTS based on that specified window.

Does lateral movement hunting require specific dependencies or components?▼

No specific dependencies or components are required. The Skill applies threat intel queries directly against enterprise endpoints to identify unauthorized remote execution and suspicious network activity.

Why focus on PsExec and WMI for lateral movement detection?▼

Focusing on PsExec and WMI targets known techniques attackers use for remote execution. Detecting service installations and suspicious network correlations during incident response identifies lateral movement effectively.

Related Skills

Explore More Data & Analytics Skills→
YukiIto1999YukiIto1999

analyzing-network-traffic-for-incidents

Detect adversary activity in PCAPs, Zeek logs, and IDS alerts.

Community
Advanced
dandyedandye
120

respond-compromised-account

Coordinate PICERL-based incident response to detect, contain, eradicate, and recover compromised accounts.

Community
Advanced
AcczdyAcczdy
2

conducting-internal-network-penetration-test

Simulate internal network penetration tests to reveal lateral movement and privilege escalation paths.

Community
Advanced
Q16GQ16G
83

malware-detect

Identify and analyze potential malware on a host using YARA rules and forensic checks.

Community
Advanced