Stats
Actions
Tags
Detects lateral movement techniques like Pass-the-Hash, PsExec, WMI execution, RDP transfers, and SMB propagation using SIEM SPL queries on Windows event logs, Sysmon, and network flows. Maps to MITRE ATT&CK TA0008.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills-zh:performing-lateral-movement-detectionThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
以下情况使用本技能：
以下情况使用本技能：
不适用于检测初始访问或外部攻击——横向移动检测专注于内部主机到主机的转移活动。
哈希传递（Pass-the-Hash）检测（EventCode 4624 含 NTLM）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
AuthenticationPackageName="NTLM"
| where TargetUserName!="ANONYMOUS LOGON" AND TargetUserName!="$"
| stats count, dc(ComputerName) AS unique_targets, values(ComputerName) AS targets
by src_ip, TargetUserName
| where unique_targets > 3
| eval alert = "可能的哈希传递：NTLM 网络登录到 ".unique_targets." 台主机"
| sort - unique_targets
| table src_ip, TargetUserName, unique_targets, count, targets, alert
越过哈希（Overpass-the-Hash）检测（使用 RC4 的 Kerberos）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
TicketEncryptionType="0x17"
| where ServiceName!="krbtgt" AND ServiceName!="$"
| stats count, dc(ServiceName) AS unique_services by src_ip, TargetUserName
| where count > 5
| eval alert = "可能的越过哈希：来自 ".src_ip." 的 RC4 Kerberos 票据"
| table _time, src_ip, TargetUserName, unique_services, count, alert
黄金票/白银票检测（T1558）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
| where TicketOptions="0x40810000" OR TicketOptions="0x40800000"
| eval ticket_lifetime = TicketExpireTime - TicketIssueTime
| where ticket_lifetime > 36000 --- >10 小时（异常）
| stats count by src_ip, TargetUserName, ServiceName, TicketEncryptionType, TicketOptions
| eval alert = "可能的黄金/白银票：异常票据属性"
PsExec 检测（T1021.002）：
--- 通过 Sysmon 进程创建
index=sysmon EventCode=1
(Image="*\\psexec.exe" OR Image="*\\psexesvc.exe"
OR OriginalFileName="psexec.c" OR OriginalFileName="psexesvc.exe"
OR ParentImage="*\\psexesvc.exe")
| table _time, Computer, User, ParentImage, Image, CommandLine, Hashes
--- 通过命名管道创建（Sysmon EventCode 17）
index=sysmon EventCode=17
PipeName IN ("\\PSEXESVC*", "\\RemCom*", "\\csexec*")
| table _time, Computer, User, Image, PipeName
--- 通过 Windows 服务创建（EventCode 7045）
index=wineventlog sourcetype="WinEventLog:System" EventCode=7045
ServiceName="PSEXESVC" OR ServiceFileName="*PSEXESVC*"
| table _time, Computer, ServiceName, ServiceFileName, AccountName
WMI 远程执行（T1047）：
index=sysmon EventCode=1
(Image="*\\wmic.exe" AND CommandLine="*/node:*")
OR (ParentImage="*\\WmiPrvSE.exe" AND Image IN ("*\\cmd.exe", "*\\powershell.exe"))
| eval execution_type = case(
match(Image, "wmic"), "WMI 命令行",
match(ParentImage, "WmiPrvSE"), "WMI 提供程序主机（远程执行）"
)
| table _time, Computer, User, execution_type, ParentImage, Image, CommandLine
WinRM/PowerShell 远程（T1021.006）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624
Logon_Type=3 AuthenticationPackageName="Kerberos"
| where ProcessName="*\\wsmprovhost.exe" OR ProcessName="*\\powershell.exe"
| stats count, dc(ComputerName) AS unique_targets by src_ip, TargetUserName
| where unique_targets > 2
| eval alert = "PowerShell 远程连接到来自 ".src_ip." 的 ".unique_targets." 台主机"
--- Sysmon 变体
index=sysmon EventCode=1
ParentImage="*\\wsmprovhost.exe"
Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\csc.exe")
| table _time, Computer, User, Image, CommandLine
RDP 横向移动（T1021.001）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=10
| stats count, dc(ComputerName) AS rdp_targets, values(ComputerName) AS destinations,
earliest(_time) AS first_rdp, latest(_time) AS last_rdp
by src_ip, TargetUserName
| where rdp_targets > 2
| eval duration_hours = round((last_rdp - first_rdp) / 3600, 1)
| eval alert = TargetUserName." 在 ".duration_hours." 小时内 RDP 连接到 ".rdp_targets." 台主机"
| sort - rdp_targets
异常 SMB 流量模式：
index=firewall OR index=zeek sourcetype IN ("pan:traffic", "bro:conn:json")
dest_port=445 action=allowed
| where src_ip!=dest_ip
| stats count AS smb_sessions, dc(dest_ip) AS unique_targets,
sum(bytes_out) AS total_bytes
by src_ip
| where unique_targets > 10
| eval alert = case(
unique_targets > 50, "严重：来自 ".src_ip." 的大量 SMB 枚举",
unique_targets > 20, "高：显著的 SMB 横向移动",
unique_targets > 10, "中：SMB 连接次数偏高"
)
| sort - unique_targets
管理共享访问（C$、ADMIN$）：
index=wineventlog sourcetype="WinEventLog:Security" EventCode=5140
ShareName IN ("\\\\*\\C$", "\\\\*\\ADMIN$", "\\\\*\\IPC$")
| where SubjectUserName!="SYSTEM" AND SubjectUserName!="$"
| stats count, dc(ComputerName) AS unique_hosts by SubjectUserName, ShareName, src_ip
| where unique_hosts > 3
| eval alert = SubjectUserName." 访问了 ".unique_hosts." 台主机的管理共享"
| sort - unique_hosts
可视化攻击路径：
--- 构建认证事件的源->目标图
index=wineventlog EventCode=4624 Logon_Type IN (3, 10)
earliest=-24h
| stats count AS connections, latest(_time) AS last_connection
by src_ip, ComputerName, TargetUserName, Logon_Type
| eval edge = src_ip." -> ".ComputerName." (用户：".TargetUserName."，类型：".Logon_Type.")"
| sort - connections
| table edge, connections, last_connection
--- 网络流关联
index=netflow earliest=-24h
dest_port IN (445, 135, 3389, 5985, 5986)
| stats sum(bytes) AS total_bytes, count AS flow_count,
dc(dest_ip) AS targets by src_ip, dest_port
| where targets > 5
| eval service = case(
dest_port=445, "SMB",
dest_port=135, "RPC/WMI",
dest_port=3389, "RDP",
dest_port IN (5985, 5986), "WinRM"
)
| sort - targets
| table src_ip, service, targets, flow_count, total_bytes
DCOM 远程执行（T1021.003）：
index=sysmon EventCode=1
ParentImage IN ("*\\mmc.exe", "*\\excel.exe", "*\\outlook.exe")
Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\mshta.exe")
| where ParentCommandLine="*-Embedding*"
| eval alert = "基于 DCOM 的横向移动：".ParentImage." 生成了 ".Image
| table _time, Computer, User, ParentImage, Image, CommandLine, alert
远程计划任务创建（T1053.005）：
index=wineventlog EventCode=4698
| where SubjectUserName!="SYSTEM"
| eval task_xml = TaskContent
| search task_xml="*http*" OR task_xml="*powershell*" OR task_xml="*cmd*" OR task_xml="*\\Temp\\*"
| table _time, Computer, SubjectUserName, TaskName, task_xml
构建端到端攻击链检测：
--- 检测完整横向移动序列
index=wineventlog OR index=sysmon
(EventCode=4625 OR EventCode=4624 OR EventCode=1 OR EventCode=4698 OR EventCode=5140)
| eval phase = case(
EventCode=4625, "1-侦察/暴力破解",
EventCode=4624 AND Logon_Type=3, "2-横向移动",
EventCode=5140 AND match(ShareName, "C\$|ADMIN\$"), "3-管理共享访问",
EventCode=1 AND match(ParentImage, "psexesvc|WmiPrvSE|wsmprovhost"), "4-远程执行",
EventCode=4698, "5-持久化（计划任务）",
1=1, "other"
)
| where phase!="other"
| stats count by phase, src_ip, ComputerName, TargetUserName
| sort phase, _time
| table phase, src_ip, ComputerName, TargetUserName, count
| 术语 | 定义 |
|---|---|
| 横向移动（Lateral Movement） | 入侵后攻击者在系统间横向转移以到达目标的技术 |
| 哈希传递（Pass-the-Hash） | 使用盗取的 NTLM 哈希进行认证，无需知道明文密码 |
| 票据传递（Pass-the-Ticket） | 使用盗取的 Kerberos TGT/TGS 票据在域内进行认证 |
| PsExec | Sysinternals 工具（及攻击技术），通过 SMB 和命名管道进行远程进程执行 |
| WMI 执行（WMI Execution） | 通过 DCOM 或 WinRM 使用 Windows 管理规范（WMI）进行远程命令执行 |
| 管理共享（Admin Share） | 默认 Windows 管理共享（C$、ADMIN$、IPC$），用于远程系统管理 |
横向移动检测报告
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
时段： 2024-03-15 14:00 至 18:00 UTC
来源： 192.168.1.105（WORKSTATION-042）
移动路径：
14:23 192.168.1.105 → 10.0.5.20（DC-PRIMARY） — 通过 NTLM Type 3 哈希传递
14:25 10.0.5.20 → 10.0.5.21（DC-BACKUP） — Kerberos 票据复用
14:28 10.0.5.20 → 10.0.10.15（FILESERVER-01） — PsExec 服务创建
14:32 10.0.10.15 → 10.0.10.20（DB-PRIMARY） — WMI 远程执行
14:35 10.0.10.20 → 10.0.10.25（DB-BACKUP） — SMB 管理共享访问
检测到的技术：
T1550.002 — 哈希传递（NTLM 认证到 DC）
T1021.002 — PsExec（远程服务安装）
T1047 — WMI 执行（WmiPrvSE 子进程）
T1021.002 — SMB 管理共享（DB-BACKUP 上的 C$ 访问）
受影响系统： 跨 2 个网络分段的 5 台主机
用户账号： admin_compromised（域管理员）
遏制措施： 5 台主机在 14:45 UTC 已隔离
npx claudepluginhub killvxk/cybersecurity-skills-zhDetects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB spreading using SIEM queries on Windows event logs, Sysmon, and network flows. Maps to MITRE ATT&CK TA0008.
Detects lateral movement techniques (Pass-the-Hash, PsExec, WMI, RDP pivoting, SMB spreading) using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK TA0008.
Detects lateral movement techniques like Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB spreading using SIEM queries on Windows event logs, Sysmon, and network flows, mapped to MITRE ATT&CK TA0008.