performing-lateral-movement-detection
mukul975/Anthropic-Cybersecurity-Skills
This skill detects advanced lateral movement techniques used by attackers after initial compromise, mapping them to MITRE ATT&CK TA0008. It correlates multiple data sources, including Windows event logs (4624, 4769), Sysmon telemetry, network flow data, and endpoint logs, to identify suspicious activities like Pass-the-Hash, PsExec, WMI exploitation, RDP pivoting, and SMB spreading.