<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: detecting-lateral-movement-in-networks
description: >-
  Detect lateral movement via SMB/RDP/WMI
domain: cybersecurity
subdomain: network-security
tags:
  - network-security
  - security-automation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021"]
---
# Detecting Lateral Movement In Networks

## Overview
Detect lateral movement via SMB/RDP/WMI. Provides structured workflows and tool integrations.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ | Required |
| Relevant domain tools installed | Required |

## Key Concepts
### Core Workflow
1. **Scope** — Define assessment boundaries
2. **Analyze** — Execute domain-specific checks
3. **Validate** — Cross-reference findings
4. **Report** — Generate structured JSON output

## Workflow
### Step 1: Run Analysis
```bash
node scripts/agent.js analyze --target <scope>
```
### Step 2: Generate Report
```bash
node scripts/agent.js report --target <scope>
```

## Detection

```yaml
title: Lateral Movement In Networks Detection
id: 583f647e-ef8d-4d92-b699-8ce605c51ad5
status: experimental
description: Detects suspicious activity related to detecting lateral movement in networks techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1021
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Lateral Movement In Networks Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1021 |

## Verification
- [ ] All scope items assessed
- [ ] Findings validated
- [ ] JSON report generated

## References
- NIST CSF 2.0
- CIS Controls v8
- MITRE ATT&CK
