<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-lateral-movement-before-deployment
description: >-
  Detect lateral movement techniques used by ransomware operators before
  encryption deployment. Covers PsExec, WMI, WinRM, RDP, SMB, and
  GPO-based deployment detection. Provides Sigma rules, KQL queries,
  and network-based detection for pre-deployment lateral movement
  patterns including Cobalt Strike and Impacket tooling.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - lateral-movement
  - psexec
  - wmi
  - winrm
  - rdp
  - cobalt-strike
  - impacket
  - smb
  - gpo-deployment
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021"]
---

# Detecting Lateral Movement Before Deployment

## Overview

Ransomware operators use lateral movement to spread from initial foothold
to domain-wide access before deploying encryption. This phase typically
occurs 3-14 days before encryption and involves predictable tool usage:
PsExec, WMI, WinRM, RDP, and GPO abuse. Detecting lateral movement is
the last reliable window before mass encryption.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Sysmon | Process and network telemetry | `sysmon64 -i config.xml` |
| Sigma CLI | Rule conversion | `pip install sigma-cli` |
| Zeek | Network protocol analysis | `apt install zeek` |
| Velociraptor | Endpoint hunting | Server + client |
| BloodHound | AD path analysis | Docker or binary |

## Key Concepts

### Lateral Movement Techniques (Ransomware Context)

| Technique | MITRE ID | Detection Source | Fidelity |
|-----------|----------|-----------------|----------|
| PsExec | T1021.002 | EID 7045 (service install) | High |
| WMI | T1047 | EID 4688 (wmiprvse.exe child) | Medium |
| WinRM | T1021.006 | EID 4688 (wsmprovhost.exe) | High |
| RDP | T1021.001 | EID 4624 Type 10 | Medium |
| SMB/Admin shares | T1021.002 | EID 5140/5145 | Medium |
| GPO deployment | T1484.001 | GPO modification events | High |
| DCOM | T1021.003 | EID 4688 (mmc.exe child) | Low |

### Pre-Deployment Movement Pattern

```
Typical ransomware lateral movement sequence:
Day 1-3: Credential harvesting
  └── Mimikatz/LSASS → domain admin credentials

Day 3-7: Internal reconnaissance
  └── AdFind, BloodHound → map AD, find targets

Day 7-14: Lateral spread
  ├── PsExec to servers → deploy tools
  ├── RDP to jump hosts → manual exploration
  ├── WMI for execution → run commands remotely
  └── SMB share access → identify data targets

Day 14+: Pre-deployment staging
  ├── GPO modification → schedule ransomware via GPO
  ├── PsExec batch deployment → push binary to all hosts
  └── Disable defenses → kill EDR, delete backups

Hour 0: Mass encryption triggered (off-hours)
```

## Workflow

### Step 1 — Sigma Rules for Lateral Movement

```yaml
# Sigma: PsExec Service Installation
title: PsExec Service Installation - Lateral Movement
id: c3a99af4-2e7b-4d8f-a1b5-6d3c9e8f2a4b
status: stable
description: Detects PsExec service installation indicating lateral movement
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: '\PSEXESVC.exe'
  selection_sysmon:
    Hashes|contains: 'IMPHASH=A16C7E7A5B0D5D8E'
  condition: selection or selection_sysmon
falsepositives:
  - Legitimate admin use of PsExec (should be logged and approved)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002

---
# Sigma: WMI Remote Process Creation
title: WMI Remote Process Execution
id: d5b8c3e7-4f2a-4c9d-b6a1-7e8d3f5c2b4a
status: stable
description: Detects WMI-based remote process creation used for lateral movement
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\wmiprvse.exe'
  filter_legitimate:
    Image|endswith:
      - '\WmiPrvSE.exe'
      - '\WmiApSrv.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - SCCM and other management tools using WMI
level: medium
tags:
  - attack.execution
  - attack.t1047

---
# Sigma: Mass RDP Lateral Movement
title: Single Account RDP to Multiple Hosts
id: e6c9d4f8-5a3b-4d0e-c7b2-8f9e4a6d3c5b
status: experimental
description: Detects single account performing RDP to many hosts in short timeframe
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 10
  condition: selection | count(TargetDomainName) by SubjectUserName > 5
  timeframe: 1h
falsepositives:
  - IT administrators managing multiple servers via RDP
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.001
```

### Step 2 — KQL for Lateral Movement Detection

```kql
// PsExec service installation
DeviceEvents
| where ActionType == "ServiceInstalled"
| where FileName =~ "PSEXESVC.exe" or AdditionalFields has "PSEXESVC"
| project Timestamp, DeviceName, AccountName, FileName

// WMI remote execution
DeviceProcessEvents
| where InitiatingProcessFileName =~ "wmiprvse.exe"
| where FileName !in~ ("WmiPrvSE.exe", "WmiApSrv.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine

// RDP lateral movement — one account, many hosts
DeviceLogonEvents
| where LogonType == "RemoteInteractive"
| summarize TargetHosts = make_set(DeviceName), HostCount = dcount(DeviceName)
    by AccountName, bin(Timestamp, 1h)
| where HostCount > 3
| sort by HostCount desc

// GPO modification (ransomware deployment via GPO)
DeviceRegistryEvents
| where RegistryKey has "GroupPolicy"
| where ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, RegistryKey, RegistryValueData
```

### Step 3 — Network-Based Detection

```bash
# Zeek — detect PsExec over SMB
zeek-cut ts id.orig_h id.resp_h service < /var/log/zeek/current/conn.log | \
  grep smb | awk '{print $2, $3}' | sort | uniq -c | sort -rn | head -20

# Zeek — detect WinRM traffic (port 5985/5986)
zeek-cut ts id.orig_h id.resp_h id.resp_p < /var/log/zeek/current/conn.log | \
  awk '$4 == 5985 || $4 == 5986' | sort | uniq -c | sort -rn

# Suricata — detect Impacket tool signatures
# Many ransomware groups use Impacket for lateral movement
grep -i "impacket\|psexec\|wmiexec\|smbexec" /var/log/suricata/fast.log
```

### Step 4 — Splunk SPL for Lateral Movement

```spl
| PsExec service installation
index=windows sourcetype=WinEventLog:System EventCode=7045
  Service_Name="PSEXESVC" OR Service_File_Name="*PSEXESVC*"
| stats count by _time, host, Account_Name, Service_File_Name

| RDP lateral movement correlation
index=windows sourcetype=WinEventLog:Security EventCode=4624 Logon_Type=10
| stats dc(host) as target_count, values(host) as targets by Account_Name
| where target_count > 3
| sort -target_count

| SMB admin share access
index=windows sourcetype=WinEventLog:Security EventCode=5140
  Share_Name="\\\\*\\ADMIN$" OR Share_Name="\\\\*\\C$"
| stats count by _time, Source_Address, Account_Name, Share_Name
```

### Step 5 — BloodHound Attack Path Analysis

```bash
# Collect AD data with SharpHound (authorized assessment)
# SharpHound.exe -c All -d domain.local --outputdirectory /evidence/

# Import to BloodHound
# Upload .zip collection to BloodHound UI

# Key queries for ransomware attack paths:
# - Shortest path to Domain Admin
# - Find all Kerberoastable accounts
# - Find computers where Domain Admins are logged in
# - List all GPOs and their links
```

## Verification

- [ ] Sigma rules for PsExec, WMI, WinRM, RDP deployed
- [ ] KQL/SPL queries returning lateral movement detections
- [ ] Network monitoring detects SMB/WinRM lateral patterns
- [ ] GPO modification monitoring active
- [ ] BloodHound analysis identifies reducible attack paths
- [ ] Alert response playbook for lateral movement tested
- [ ] Baseline established for legitimate admin tool usage

## References

- MITRE ATT&CK TA0008: Lateral Movement
- MITRE ATT&CK T1021: Remote Services
- MITRE ATT&CK T1047: Windows Management Instrumentation
- CISA Alert: Pre-Ransomware Lateral Movement Indicators
