detecting-lateral-movement-with-splunk

name	detecting-lateral-movement-with-splunk
description	Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI/PsExec/RDP) abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating suspected pivoting between hosts during an incident, with Splunk as the SIEM.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","mitre-attack","lateral-movement","splunk","siem","proactive-detection","ta0008"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]
mitre_attack	["T1046","T1057","T1082","T1083","T1021"]

Detecting Lateral Movement with Splunk

When to Use

• When hunting for adversary movement between compromised systems
• After detecting credential theft to trace subsequent lateral activity
• When investigating unusual authentication patterns across the network
• During incident response to scope the breadth of compromise
• When proactively hunting for TA0008 (Lateral Movement) techniques

Prerequisites

• Splunk Enterprise or Splunk Cloud with Windows event data ingested
• Windows Security Event Logs forwarded (4624, 4625, 4648, 4672, 4768, 4769)
• Sysmon deployed for process creation and network connection data
• Network flow data or firewall logs for SMB/RDP/WinRM correlation
• Active Directory user and group membership reference data

Workflow

1. Define Lateral Movement Scope: Identify which lateral movement techniques to hunt (RDP, SMB/Admin Shares, WinRM, PsExec, WMI, DCOM, SSH).
2. Query Authentication Events: Use SPL to search for Type 3 (Network) and Type 10 (RemoteInteractive) logons across the environment.
3. Build Authentication Graphs: Map source-to-destination authentication relationships to identify unusual connection patterns.
4. Detect First-Time Relationships: Identify new source-destination pairs that have not been seen in the historical baseline.
5. Correlate with Process Activity: Link authentication events to subsequent process creation on destination hosts.
6. Identify Anomalous Patterns: Flag lateral movement to sensitive servers, unusual hours, service account misuse, or rapid multi-host access.
7. Report and Contain: Document lateral movement path, affected systems, and coordinate containment response.

Key Concepts

Concept	Description
T1021	Remote Services (parent technique)
T1021.001	Remote Desktop Protocol (RDP)
T1021.002	SMB/Windows Admin Shares
T1021.003	Distributed COM (DCOM)
T1021.004	SSH
T1021.006	Windows Remote Management (WinRM)
T1570	Lateral Tool Transfer
T1047