detecting-lateral-movement-with-splunk

# Detecting Lateral Movement with Splunk ## When to Use - When hunting for adversary movement between compromised systems - After detecting credential theft to trace subsequent lateral activity - When investigating unusual authentication patterns across the network - During incident response to scope the breadth of compromise - When proactively hunting for TA0008 (Lateral Movement) techniques ## Prerequisites - Splunk Enterprise or Splunk Cloud with Windows event data ingested - Windows Security Event Logs forwarded (4624, 4625, 4648, 4672, 4768, 4769) - Sysmon deployed for process creation and network connection data - Network flow data or firewall logs for SMB/RDP/WinRM correlation - Active Directory user and group membership reference data ## Workflow 1. **Define Lateral Movement Scope**: Identify which lateral movement techniques to hunt (RDP, SMB/Admin Shares, WinRM, PsExec, WMI, DCOM, SSH). 2. **Query Authentication Events**: Use SPL to search for Type 3 (Network) and Type 10 (RemoteInteractive) logons across the environment. 3. **Build Authentication Graphs**: Map source-to-destination authentication relationships to identify unusual connection patterns. 4. **Detect First-Time Relationships**: Identify new source-destination pairs that have not been seen in the historical baseline. 5. **Correlate with Process Activity**: Link authentication events to subsequent process creation on destination hosts. 6. **Identify Anomalous Patterns**: Flag lateral movement to sen...