Skill UI

This guide outlines a comprehensive threat hunting methodology for detecting adversary lateral movement within a network environment. It utilizes Splunk SPL queries against rich Windows event data, including authentication logs (4624, 4625), SMB traffic, and Sysmon telemetry. By correlating source-to-destination activity and identifying unusual logon types (RDP, WinRM, SMB), users can proactively track an attacker's path after initial system compromise, fulfilling MITRE ATT&CK T1021 techniques.

A comprehensive playbook detailing expert techniques for lateral movement across Windows networks. It covers various protocols and methods for pivoting between compromised hosts, including PsExec, WMI, WinRM, DCOM, SMB, RDP, and advanced credential techniques like Pass-the-Hash (PTH) and Pass-the-Ticket (PTT).

NetExec is a powerful, protocol-oriented tool for penetration testing, designed for assessing and exploiting Windows and Active Directory environments. It facilitates lateral movement by authenticating over protocols like SMB, WinRM, LDAP, and MSSQL. Key functions include password spraying, comprehensive network enumeration, command execution, and dumping critical credentials (SAM, LSA, NTDS) during post-exploitation phases.