<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Lateral Movement

## Key Event IDs

| Event ID | Source | Lateral Movement Indicator |
|---|---|---|
| 4624 Type 3 | Security | Network logon (SMB, WMI, WinRM) |
| 4624 Type 10 | Security | RDP logon |
| 7045 | System | Service installed (PsExec) |
| 5140/5145 | Security | Network share access |
| 4648 | Security | Explicit credential use |
| Sysmon 3 | Sysmon | Network connection (port 445, 135, 5985) |
| Sysmon 17/18 | Sysmon | Named pipe created/connected |

## Agent Script

```bash
# List lateral movement techniques
node agent.js list

# Get technique details
node agent.js get psexec

# Assess detection coverage
node agent.js assess --sources sysmon windows_security network_flow
```
