From cybersec-toolkit
Detects WMI-based lateral movement by analyzing Windows Event ID 4688 and Sysmon Event ID 1 for WmiPrvSE.exe child processes, remote execution patterns, and WMI event subscription persistence.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:hunting-for-lateral-movement-via-wmiThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Windows Management Instrumentation (WMI) is commonly abused for lateral movement via `wmic process call create` or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) f...
Windows Management Instrumentation (WMI) is commonly abused for lateral movement via wmic process call create or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) for event subscription persistence.
python-evtx, lxml librariesExtract Event ID 4688 and Sysmon Event 1 entries from EVTX files.
Flag processes where ParentImage/ParentProcessName is WmiPrvSE.exe, indicating remote WMI execution.
Identify suspicious command lines matching WMI lateral movement patterns (cmd.exe /q /c, output redirection to admin$ share).
Parse WMI-Activity/Operational log for event consumer creation indicating persistence.
JSON report with WMI-spawned processes, suspicious command lines, WMI event subscription alerts, and timeline of lateral movement activity.
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitDetects WMI-based lateral movement by analyzing Windows Event ID 4688 and Sysmon Event ID 1 for WmiPrvSE.exe child processes, remote execution patterns, and WMI event subscription persistence.
Detects WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 logs for WmiPrvSE.exe child processes, remote execution, and event subscription persistence.
Detects WMI-based lateral movement by analyzing Windows event ID 4688 process creations, Sysmon ID 1 WmiPrvSE.exe child processes, remote executions, and event subscription persistence in logs.