<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: analyzing-lateral-movement-artifacts
description: >-
  Analyzes lateral movement artifacts including PsExec, WMI, RDP, WinRM, SMB,
  and DCOM evidence across Windows environments to map attacker progression
  and identify compromised systems during incident response.
domain: cybersecurity
subdomain: incident-response
tags:
  - lateral-movement
  - PsExec
  - WMI
  - RDP
  - WinRM
  - SMB
  - pass-the-hash
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021"]
---

# Analyzing Lateral Movement Artifacts

## Overview

Lateral movement is how attackers expand from initial access to additional systems.
Detecting and mapping lateral movement is critical for determining the full scope
of compromise. This skill covers artifact analysis for common lateral movement
techniques: PsExec/SMB, WMI, RDP, WinRM, DCOM, and pass-the-hash/pass-the-ticket
attacks.

Each technique leaves distinct forensic artifacts across source and destination
systems. Correlating these artifacts across the network builds the attacker's
movement map and identifies all compromised hosts.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Chainsaw | EVTX triage | GitHub release binary |
| Hayabusa | Timeline generation | GitHub release binary |
| Velociraptor | Remote artifact collection | GitHub release |
| PowerShell | Log analysis | Pre-installed |
| Sysmon logs | Process/network telemetry | Sysmon installed on endpoints |

## Key Concepts

### Lateral Movement Technique Artifacts

| Technique | Source Artifacts | Destination Artifacts |
|-----------|-----------------|----------------------|
| PsExec | Sysmon Event 1 (psexec.exe), Event 3 (SMB 445) | Event 7045 (PSEXESVC), Event 4624 Type 3 |
| WMI | Sysmon Event 1 (wmic.exe), Event 3 (port 135) | Event 4624 Type 3, WMI-Activity log |
| RDP | Event 4648 (explicit creds), Sysmon Event 3 (3389) | Event 4624 Type 10, RDP bitmap cache |
| WinRM | Sysmon Event 1 (wsmprovhost), Event 3 (5985/5986) | Event 4624 Type 3, PowerShell logs |
| DCOM | Sysmon Event 1, Event 3 (port 135) | Event 4624 Type 3, Event 4688 |
| Pass-the-Hash | N/A (in-memory) | Event 4624 Type 3 with NTLM, LogonProcess: NtLmSsp |
| Pass-the-Ticket | N/A (in-memory) | Event 4624 Type 3 with Kerberos, anomalous SPN |

### Key Event IDs for Lateral Movement

| Event ID | Log | Indicates |
|----------|-----|-----------|
| 4624 | Security | Logon success — check Type 3, 10 |
| 4648 | Security | Explicit credential use (RunAs, RDP) |
| 4672 | Security | Privileged logon (admin movement) |
| 7045 | System | Service creation (PsExec pattern) |
| 4688 | Security | Process creation on destination |
| 1 | Sysmon | Process creation with parent info |
| 3 | Sysmon | Network connection (source system) |

## Workflow

### Step 1 — Collect Lateral Movement Artifacts

```bash
# Hayabusa — filter for lateral movement events
hayabusa csv-timeline -d /evidence/evtx/ -o /evidence/lateral.csv \
  --min-level medium

# Chainsaw — search for PsExec indicators
chainsaw search /evidence/evtx/ -s "PSEXESVC"
chainsaw search /evidence/evtx/ -s "wmiprvse"
```

### Step 2 — Detect PsExec Usage

```powershell
# Service installation (PSEXESVC pattern)
Get-WinEvent -Path D:\evidence\System.evtx -FilterHashtable @{Id=7045} |
  Where-Object { $_.Properties[0].Value -match "PSEXE" -or
                 $_.Properties[1].Value -match "\\\\ADMIN\$" } |
  Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}},
    @{N='Path';E={$_.Properties[1].Value}}

# Sysmon process creation for PsExec
Get-WinEvent -Path D:\evidence\Sysmon.evtx -FilterHashtable @{Id=1} |
  Where-Object { $_.Properties[4].Value -match "psexe" } |
  Select-Object TimeCreated, @{N='Image';E={$_.Properties[4].Value}},
    @{N='CommandLine';E={$_.Properties[10].Value}}
```

### Step 3 — Detect WMI Lateral Movement

```powershell
# WMI process creation on destination
Get-WinEvent -Path D:\evidence\Sysmon.evtx -FilterHashtable @{Id=1} |
  Where-Object { $_.Properties[20].Value -match "WmiPrvSE" } |
  Select-Object TimeCreated, @{N='Image';E={$_.Properties[4].Value}},
    @{N='Parent';E={$_.Properties[20].Value}},
    @{N='CommandLine';E={$_.Properties[10].Value}}

# WMI-Activity operational log
Get-WinEvent -Path "D:\evidence\Microsoft-Windows-WMI-Activity*.evtx" |
  Select-Object TimeCreated, Id, Message | Format-Table -Wrap
```

### Step 4 — Map RDP Sessions

```powershell
# Successful RDP logons (Type 10)
Get-WinEvent -Path D:\evidence\Security.evtx -FilterHashtable @{Id=4624} |
  Where-Object { $_.Properties[8].Value -eq 10 } |
  Select-Object TimeCreated,
    @{N='User';E={$_.Properties[5].Value}},
    @{N='SourceIP';E={$_.Properties[18].Value}},
    @{N='Workstation';E={$_.Properties[11].Value}}

# RDP connection events from TerminalServices log
Get-WinEvent -Path "D:\evidence\Microsoft-Windows-TerminalServices-*" |
  Where-Object { $_.Id -in @(1149, 21, 22, 25) } |
  Select-Object TimeCreated, Id, Message
```

### Step 5 — Build Movement Map

```bash
# Extract source-destination pairs from Type 3/10 logons
grep -E "LogonType.*(3|10)" /evidence/lateral.csv | \
  awk -F, '{print $5 " -> " $3}' | sort | uniq -c | sort -rn > /evidence/movement_map.txt

# Visualize as timeline
cat /evidence/movement_map.txt
# Expected output:
#   15 10.0.1.50 -> DC01
#    8 10.0.1.50 -> FILE01
#    3 DC01 -> SQL01
```

## Detection

```yaml
title: Lateral Movement Artifacts Detection
id: e46cb0f6-9706-4a0e-aee2-7002a38a18ab
status: experimental
description: Detects suspicious activity related to analyzing lateral movement artifacts techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*lateral*"
  condition: selection
level: high
tags:
  - attack.t1021
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] PsExec artifacts checked (PSEXESVC service, SMB connections)
- [ ] WMI lateral movement events analyzed (WmiPrvSE parent processes)
- [ ] RDP sessions mapped with source IPs and usernames
- [ ] WinRM/DCOM artifacts reviewed
- [ ] Pass-the-hash indicators checked (NTLM Type 3 with NtLmSsp)
- [ ] Source-destination movement map constructed
- [ ] All compromised hosts identified and scoped
- [ ] Timeline of lateral movement correlated with initial access

## References

- SANS Lateral Movement Detection Cheat Sheet
- MITRE ATT&CK T1021 (Remote Services)
- MITRE ATT&CK T1047 (Windows Management Instrumentation)
- MITRE ATT&CK T1570 (Lateral Tool Transfer)
- MITRE ATT&CK T1550 (Use Alternate Authentication Material)
- JPCERT Lateral Movement Detection: https://jpcertcc.github.io/ToolAnalysisResultSheet/
