GitHub Repo

Lateral Movement Detections

Name Data Source Technique Type Analytic Story Date
Microsoft Intune Mobile Apps Azure Monitor Activity T1021.007 T1072 T1105 T1202 Hunting Azure Active Directory Account Takeover 2026-05-13
Microsoft Intune Device Health Scripts Azure Monitor Activity T1021.007 T1072 T1105 T1202 Hunting Azure Active Directory Account Takeover 2026-05-13
AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity AWS CloudTrail T1021.004 T1021.008 TTP Suspicious Cloud Instance Activities 2026-09-29
Microsoft Intune Manual Device Management Azure Monitor Activity T1021.007 T1072 T1529 Hunting Azure Active Directory Account Takeover 2026-05-13
AWS Bedrock Invoke Model Access Denied AWS CloudTrail T1078 T1550 TTP AWS Bedrock Security 2026-05-13
Microsoft Intune DeviceManagementConfigurationPolicies Azure Monitor Activity T1021.007 T1072 T1484 T1685 T1686 Hunting Azure Active Directory Account Takeover 2026-05-13
Windows RDP File Execution Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.001 T1598.002 TTP Spearphishing Attachments, Interlock Ransomware, Windows RDP Artifacts and Defense Evasion 2026-05-13
Windows Steal Authentication Certificates - ESC1 Authentication Windows Event Log Security 4768, Windows Event Log Security 4887 T1550 T1649 TTP Windows Certificate Services, Compromised Windows Host 2026-05-13
Detect Computer Changed with Anonymous Account Windows Event Log Security 4742 T1210 Hunting Detect Zerologon Attack 2026-05-13
Remote Process Instantiation via DCOM and PowerShell Script Block Powershell Script Block Logging 4104 T1021.003 TTP Active Directory Lateral Movement 2026-05-13
Windows RDP Connection Successful Windows Event Log RemoteConnectionManager 1149 T1563.002 Hunting BlackByte Ransomware, NetSupport RMM Tool Abuse, Windows RDP Artifacts and Defense Evasion, Active Directory Lateral Movement, Interlock Ransomware 2026-05-13
Windows Suspicious C2 Named Pipe Sysmon EventID 18, Sysmon EventID 17 T1021.002 T1055 T1559 TTP Hellcat Ransomware, Storm-0501 Ransomware, Tuoni, Gozi Malware, Cobalt Strike, BlackByte Ransomware, DarkSide Ransomware, APT37 Rustonotto and FadeStealer, Remote Monitoring and Management Software, Meterpreter, Graceful Wipe Out Attack, LockBit Ransomware, Trickbot, Brute Ratel C4 2026-09-22
Windows Azure PowerShell Module Installation Via PowerShell Script Powershell Script Block Logging 4104 T1021.007 T1069.003 T1078 T1098 T1136.003 Anomaly Azure Active Directory Privilege Escalation, Azure Active Directory Account Takeover, Azure Active Directory Persistence 2026-05-13
Windows SpeechRuntime COM Hijacking DLL Load Sysmon EventID 7 T1021.003 TTP Active Directory Lateral Movement, Compromised Windows Host, Scattered Lapsus$ Hunters 2026-05-13
Remote Process Instantiation via WinRM and PowerShell Script Block Powershell Script Block Logging 4104 T1021.006 TTP Active Directory Lateral Movement 2026-05-13
Interactive Session on Remote Endpoint with PowerShell Powershell Script Block Logging 4104 T1021.006 TTP Active Directory Lateral Movement 2026-05-13
Windows AD Suspicious Attribute Modification Windows Event Log Security 5136 T1222.001 T1550 TTP Sneaky Active Directory Persistence Tricks 2026-05-13
Rubeus Kerberos Ticket Exports Through Winlogon Access Sysmon EventID 10 T1550.003 TTP CISA AA23-347A, Active Directory Kerberos Attacks, ZOVWiper, BlackSuit Ransomware, Scattered Lapsus$ Hunters 2026-09-08
Windows RDP Login Session Was Established Windows Event Log Security 4624 T1021.001 Anomaly Scattered Lapsus$ Hunters, Windows RDP Artifacts and Defense Evasion 2026-05-13
Executable File Written in Administrative SMB Share Windows Event Log Security 5145 T1021.002 TTP Prestige Ransomware, Hermetic Wiper, Industroyer2, Compromised Windows Host, Graceful Wipe Out Attack, BlackSuit Ransomware, IcedID, Active Directory Lateral Movement, Data Destruction, Trickbot, VanHelsing Ransomware 2026-08-05
Kerberos TGT Request Using RC4 Encryption Windows Event Log Security 4768 T1550 TTP Active Directory Kerberos Attacks, Scattered Lapsus$ Hunters 2026-05-13
Powershell Remote Services Add TrustedHost Powershell Script Block Logging 4104 T1021.006 TTP DarkGate Malware 2026-05-13
Windows Special Privileged Logon On Multiple Hosts Windows Event Log Security 4672 T1021.002 T1087 T1135 TTP Active Directory Lateral Movement, Compromised Windows Host, Active Directory Privilege Escalation 2026-05-13
Windows RMM Named Pipe Sysmon EventID 18, Sysmon EventID 17 T1021.002 T1055 T1559 Anomaly Cactus Ransomware, CISA AA24-241A, Command And Control, Gozi Malware, Scattered Spider, Insider Threat, Seashell Blizzard, Ransomware, Remote Monitoring and Management Software, GhostRedirector IIS Module and Rungan Backdoor, Interlock Ransomware, Scattered Lapsus$ Hunters 2026-09-22
Windows Alternate Data Stream Created Over Local Share Windows Event Log Security 5145 T1021.002 T1564.004 Anomaly RoguePlanet 2026-09-30
Windows Suspicious Named Pipe Sysmon EventID 18, Sysmon EventID 17 T1021.002 T1055 T1559 TTP Hellcat Ransomware, Tuoni, Gozi Malware, DarkSide Ransomware, Cobalt Strike, BlackByte Ransomware, APT37 Rustonotto and FadeStealer, Remote Monitoring and Management Software, Meterpreter, Graceful Wipe Out Attack, LockBit Ransomware, Trickbot, Brute Ratel C4 2026-09-22
Allow Inbound Traffic In Firewall Rule Powershell Script Block Logging 4104 T1021.001 TTP Prohibited Traffic Allowed or Protocol Mismatch, NetSupport RMM Tool Abuse 2026-05-13
Windows PUA Named Pipe Sysmon EventID 18, Sysmon EventID 17 T1021.002 T1055 T1559 Anomaly Medusa Ransomware, Volt Typhoon, Cactus Ransomware, HAFNIUM Group, Rhysida Ransomware, DarkSide Ransomware, BlackByte Ransomware, DHS Report TA18-074A, SamSam Ransomware, CISA AA22-320A, DarkGate Malware, IcedID, Active Directory Lateral Movement, Seashell Blizzard, Sandworm Tools, VanHelsing Ransomware 2026-09-22
Cisco Secure Firewall - Static Tundra Smart Install Abuse Cisco Secure Firewall Threat Defense Intrusion Event T1190 T1210 T1499 TTP Cisco Smart Install Remote Code Execution CVE-2018-0171, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Lumma Stealer Activity Cisco Secure Firewall Threat Defense Intrusion Event T1027 T1190 T1204 T1210 TTP Lumma Stealer, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - SSH Connection to sshd_operns Cisco Secure Firewall Threat Defense Intrusion Event T1021.004 Anomaly Salt Typhoon, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - SSH Connection to Non-Standard Port Cisco Secure Firewall Threat Defense Intrusion Event T1021.004 Anomaly Salt Typhoon, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Unusual SSH Client Banner Zeek SSH T1021.004 T1572 Anomaly Command And Control, Ingress Tool Transfer 2026-10-12
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity Cisco Secure Firewall Threat Defense Intrusion Event T1003.001 T1059.001 T1190 T1210 TTP Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Communication Over Suspicious Ports Cisco Secure Firewall Threat Defense Connection Event T1021 T1055 T1059.001 T1105 T1219 T1571 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-10-08
Splunk RCE via User XSLT T1210 Hunting Splunk Vulnerabilities 2026-05-14
Okta Multiple Failed Requests to Access Applications Okta T1538 T1550.004 Hunting Okta Account Takeover 2026-05-13
Cisco IOS XE VTY Access Class Tampering Cisco IOS Logs T1021 T1562 Anomaly Salt Typhoon 2026-05-20
ESXi SSH Enabled VMWare ESXi Syslog T1021.004 TTP Black Basta Ransomware, Hellcat Ransomware, ESXi Post Compromise 2026-05-13
Cisco IOS XE Remote Access Probe Burst Cisco IOS Logs T1018 T1021.004 T1046 Anomaly Salt Typhoon 2026-05-20
ESXi Shell Access Enabled VMWare ESXi Syslog T1021 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
Splunk RCE Through Arbitrary File Write to Windows System Root Splunk T1210 Hunting Splunk Vulnerabilities 2026-06-23
VMWare Aria Operations Exploit Attempt Palo Alto Network Threat T1068 T1133 T1190 T1210 TTP VMware Aria Operations vRealize CVE-2023-20887 2026-05-13
Windows Protocol Tunneling with Plink Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.004 T1572 TTP CISA AA22-257A 2026-05-13
Windows RDP Server Registry Entry Created Sysmon EventID 13 T1021.001 Anomaly Windows RDP Artifacts and Defense Evasion 2026-05-13
Windows Theme File Creation in Unusual Location Sysmon EventID 11 T1021.002 T1187 T1557.001 Anomaly Spearphishing Attachments 2026-05-13
Unknown Process Using The Kerberos Protocol Sysmon EventID 1, Sysmon EventID 3 T1550 TTP Active Directory Kerberos Attacks, BlackSuit Ransomware 2026-05-13
Windows MSTSC RDP Commandline Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.001 Anomaly Medusa Ransomware, Windows RDP Artifacts and Defense Evasion 2026-05-13
Windows Process With NetExec Command Line Parameters Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1550.003 T1558.003 T1558.004 TTP Active Directory Kerberos Attacks, Active Directory Privilege Escalation 2026-05-13
Windows Service Create with Tscon Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1543.003 T1563.002 TTP Active Directory Lateral Movement, Compromised Windows Host, Windows RDP Artifacts and Defense Evasion 2026-10-02
Windows Process Execution From RDP Share Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.001 T1059 T1105 Anomaly Hidden Cobra Malware 2026-05-13
Windows Remote Management Execute Shell Sysmon EventID 1, Windows Event Log Security 4688 T1021.006 T1059 Anomaly CISA AA23-347A, Rhysida Ransomware, Living Off The Land, Unusual Processes, Crypto Stealer, Microsoft WSUS CVE-2025-59287 2026-10-29
Windows Remote Services Rdp Enable Sysmon EventID 13 T1021.001 TTP Medusa Ransomware, Azorult, BlackSuit Ransomware, Windows RDP Artifacts and Defense Evasion 2026-05-13
Windows RDP Bitmap Cache File Creation Sysmon EventID 11 T1021.001 Anomaly Windows RDP Artifacts and Defense Evasion 2026-05-13
Possible Lateral Movement PowerShell Spawn Sysmon EventID 1 T1021.003 T1021.006 T1047 T1053.005 T1059.001 T1218.014 T1543.003 Anomaly Hermetic Wiper, CISA AA24-241A, Malicious PowerShell, Microsoft WSUS CVE-2025-59287, Active Directory Lateral Movement, Data Destruction, Scheduled Tasks 2026-10-09
Windows Excel Spawning Microsoft Project Application Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.003 Anomaly PathWiper 2026-05-13
Windows Remote Services Allow Remote Assistance Sysmon EventID 13 T1021.001 Anomaly Azorult 2026-05-13
Wsmprovhost LOLBAS Execution Process Spawn Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.006 TTP Active Directory Lateral Movement, CISA AA24-241A, Hellcat Ransomware 2026-05-13
Windows SpeechRuntime Suspicious Child Process Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.003 TTP Active Directory Lateral Movement, Compromised Windows Host 2026-05-13
Windows Default RDP File Creation By Non MSTSC Process Sysmon EventID 1, Sysmon EventID 11 T1021.001 Anomaly Windows RDP Artifacts and Defense Evasion 2026-05-13
Impacket Lateral Movement Commandline Parameters Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.002 T1021.003 T1047 T1543.003 TTP Prestige Ransomware, Volt Typhoon, Industroyer2, Storm-0501 Ransomware, Gozi Malware, Compromised Windows Host, CISA AA22-277A, Graceful Wipe Out Attack, Active Directory Lateral Movement, Data Destruction, WhisperGate 2026-05-13
Windows Replication Through Removable Media Sysmon EventID 11 T1091 TTP China-Nexus Threat Activity, NjRAT, APT37 Rustonotto and FadeStealer, Chaos Ransomware, Salt Typhoon, Derusbi, PlugX 2026-05-13
Remote Process Instantiation via WinRM and PowerShell Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.006 TTP Active Directory Lateral Movement 2026-05-13
Remote Process Instantiation via WinRM and Winrs Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.006 TTP Active Directory Lateral Movement 2026-05-13
Windows Process Executed From Removable Media Sysmon EventID 1, Sysmon EventID 13 T1025 T1091 T1200 Anomaly APT37 Rustonotto and FadeStealer, Data Protection 2026-05-13
Enable RDP In Other Port Number Sysmon EventID 13 T1021 TTP Prohibited Traffic Allowed or Protocol Mismatch, Interlock Ransomware, Windows Registry Abuse, Windows RDP Artifacts and Defense Evasion 2026-05-13
Allow Inbound Traffic By Firewall Rule Registry Sysmon EventID 13 T1021.001 TTP Medusa Ransomware, Windows Registry Abuse, Prohibited Traffic Allowed or Protocol Mismatch, NjRAT, Azorult, PlugX 2026-05-13
Windows RDP Client Launched with Admin Session Sysmon EventID 1 T1021.001 Anomaly Windows RDP Artifacts and Defense Evasion 2026-05-13
Windows PuTTY Suite Utility Execution Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.004 Anomaly Active Directory Lateral Movement, Command And Control 2026-05-13
Active Directory Lateral Movement Identified T1210 Correlation Active Directory Lateral Movement 2026-05-13
Mimikatz PassTheTicket CommandLine Parameters Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1550.003 TTP CISA AA23-347A, Active Directory Kerberos Attacks, CISA AA22-320A, Sandworm Tools, Scattered Lapsus$ Hunters 2026-05-13
Rubeus Command Line Parameters Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1550.003 T1558.003 T1558.004 TTP CISA AA23-347A, Active Directory Kerberos Attacks, Active Directory Privilege Escalation, ZOVWiper, BlackSuit Ransomware, Scattered Lapsus$ Hunters 2026-05-13
Windows USBSTOR Registry Key Modification Sysmon EventID 13, Sysmon EventID 12 T1025 T1091 T1200 Anomaly APT37 Rustonotto and FadeStealer, Data Protection 2026-05-13
Impacket Lateral Movement smbexec CommandLine Parameters Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.002 T1021.003 T1047 T1543.003 TTP Prestige Ransomware, Volt Typhoon, Industroyer2, Compromised Windows Host, CISA AA22-277A, Graceful Wipe Out Attack, Active Directory Lateral Movement, Data Destruction, WhisperGate 2026-05-13
Mmc LOLBAS Execution Process Spawn Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.003 T1218.014 TTP Active Directory Lateral Movement, Living Off The Land, Water Gamayun, XML Runner Loader 2026-05-13
Remote Desktop Process Running On System Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.001 Hunting Active Directory Lateral Movement, Hidden Cobra Malware, Windows RDP Artifacts and Defense Evasion 2026-05-13
Windows Default Rdp File Unhidden Sysmon EventID 1 T1021.001 Anomaly Windows RDP Artifacts and Defense Evasion 2026-05-13
Remote Process Instantiation via DCOM and PowerShell Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.003 TTP Active Directory Lateral Movement, Compromised Windows Host 2026-05-13
Linux Suspicious Redis Activity Sysmon for Linux EventID 1 T1210 T1505 TTP Command And Control, Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Post-Exploitation, Linux Privilege Escalation 2026-07-08
Windows Remote Service Rdpwinst Tool Execution Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.001 TTP Compromised Windows Host, Scattered Lapsus$ Hunters, Azorult, Windows RDP Artifacts and Defense Evasion 2026-05-13
Detect PsExec With accepteula Flag Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.002 TTP Medusa Ransomware, Volt Typhoon, Storm-0501 Ransomware, Rhysida Ransomware, HAFNIUM Group, Cactus Ransomware, DarkSide Ransomware, BlackByte Ransomware, DHS Report TA18-074A, SamSam Ransomware, CISA AA22-320A, DarkGate Malware, IcedID, Active Directory Lateral Movement, Seashell Blizzard, Sandworm Tools, VanHelsing Ransomware 2026-10-09
Windows WPDBusEnum Registry Key Modification Sysmon EventID 13, Sysmon EventID 12 T1025 T1091 T1200 Anomaly APT37 Rustonotto and FadeStealer, Data Protection 2026-05-13
Windows Remote Services Allow Rdp In Firewall Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.001 Anomaly Azorult, Windows RDP Artifacts and Defense Evasion 2026-05-13
Windows Remote Host Computer Management Access Sysmon EventID 1, Windows Event Log Security 4688 T1021.006 Anomaly Medusa Ransomware 2026-05-13
Impacket Lateral Movement WMIExec Commandline Parameters Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.002 T1021.003 T1047 T1543.003 TTP Prestige Ransomware, Volt Typhoon, Industroyer2, Storm-0501 Ransomware, Gozi Malware, Compromised Windows Host, CISA AA22-277A, Graceful Wipe Out Attack, Active Directory Lateral Movement, Data Destruction, WhisperGate 2026-10-09
Linux SSH Remote Services Script Execute Sysmon for Linux EventID 1 T1021.004 TTP Hellcat Ransomware, Linux Living Off The Land, VoidLink Cloud-Native Linux Malware 2026-05-13
Cisco Network Interface Modifications Cisco IOS Logs T1021 T1133 T1556 Anomaly Cisco Smart Install Remote Code Execution CVE-2018-0171 2026-05-13
Cisco Privileged Account Creation with Suspicious SSH Activity T1021.004 T1078 T1136 Correlation Salt Typhoon, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Privileged Account Creation with HTTP Command Execution T1021.004 T1078 T1136 Correlation Salt Typhoon, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
SMB Traffic Spike T1021.002 Anomaly Hidden Cobra Malware, Ransomware, Emotet Malware DHS Report TA18-201A, DHS Report TA18-074A 2026-05-13
Remote Desktop Network Traffic Zeek Conn T1021.001 Anomaly Ryuk Ransomware, Hidden Cobra Malware, SamSam Ransomware, Windows RDP Artifacts and Defense Evasion, Active Directory Lateral Movement 2026-05-13
Detection of tools built by NirSoft Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1072 Anomaly Emotet Malware DHS Report TA18-201A 2026-10-01