<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Endpoint Lateral Movement

## Windows Security Events

| Event ID | Description |
|---|---|
| 4624 Type 3 | Network logon (SMB, WMI) |
| 4624 Type 10 | RDP logon |
| 4648 | Explicit credential logon |
| 5145 | SMB share access |

## Sysmon Events

| Event ID | Description |
|---|---|
| 1 | Process creation (PsExec, WMI child) |
| 3 | Network connection (lateral ports) |
| 17/18 | Named pipe created/connected |

## Key Ports

| Port | Protocol |
|---|---|
| 445 | SMB |
| 3389 | RDP |
| 5985/5986 | WinRM |
| 135 | RPC/WMI |

## Agent Script

```bash
node agent.js analyze-connections --log connections.csv
node agent.js parse-logons --log logon_events.txt
node agent.js generate-rules
```
