<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Lateral Movement via Identity

## Authentication Log Sources

### Windows Security Events

| Event ID | Log | Description |
|----------|-----|-------------|
| 4624 | Security | Successful logon (all types) |
| 4625 | Security | Failed logon attempt |
| 4648 | Security | Logon with explicit credentials |
| 4672 | Security | Special privileges assigned to logon |
| 4776 | Security | NTLM credential validation |
| 4768 | Security | Kerberos TGT requested |
| 4769 | Security | Kerberos service ticket requested |

### Logon Type Reference

| Type | Name | Lateral Movement Relevance |
|------|------|---------------------------|
| 2 | Interactive | Console access |
| 3 | Network | SMB, WMI, WinRM (primary LM vector) |
| 4 | Batch | Scheduled task execution |
| 7 | Unlock | Screen unlock |
| 9 | NewCredentials | RunAs /netonly |
| 10 | RemoteInteractive | RDP |

## Network Correlation Sources

| Source | Data Type | Correlation Key |
|--------|-----------|----------------|
| Zeek/Bro | Connection logs | src_ip + dst_ip + service |
| NetFlow/IPFIX | Flow records | src_ip + dst_ip + port |
| Firewall logs | Allow/deny events | src_ip + dst_ip + action |
| DNS logs | Resolution events | Query + response + client_ip |

## Identity-Aware Security Tools

| Tool | Capability | Integration |
|------|-----------|-------------|
| Microsoft ATA/AATP | AD lateral movement detection | Windows Event + ETW |
| CrowdStrike Falcon Identity | Identity threat detection | AD + cloud IdP |
| Semperis DSP | AD change monitoring | Directory replication |
| Silverfort | Identity firewall | MFA on any protocol |
| Vectra AI | Identity threat detection | Network + identity correlation |

## SIEM Correlation Rules

| Rule | Sources | Logic |
|------|---------|-------|
| Multi-hop Detection | 4624 events | Same account, 3+ targets in 1 hour |
| Protocol Downgrade | 4624 + 4776 | NTLM auth in Kerberos-only zone |
| Service Account Pivot | 4624 + 4648 | Service account interactive logon |
| RDP Chain | 4624 Type 10 | Sequential RDP from non-admin |
| Credential Relay | 4624 + NetFlow | NTLM auth + immediate new connection |
