<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Lateral Movement Artifacts — API Reference

## Event Log Queries

### PsExec Detection

```powershell
# Service installation (PSEXESVC)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} |
  Where-Object { $_.Properties[0].Value -match "PSEXE" }

# Sysmon process creation
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} |
  Where-Object { $_.Properties[4].Value -match "psexe" }
```

### WMI Lateral Movement

```powershell
# WmiPrvSE child processes
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} |
  Where-Object { $_.Properties[20].Value -match "WmiPrvSE" }

# WMI Activity log
Get-WinEvent -LogName 'Microsoft-Windows-WMI-Activity/Operational'
```

### RDP Sessions

```powershell
# Type 10 logons (RDP)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} |
  Where-Object { $_.Properties[8].Value -eq 10 }

# TerminalServices connection events
Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' |
  Where-Object { $_.Id -eq 1149 }
```

### Pass-the-Hash Indicators

```powershell
# NTLM Type 3 logons
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} |
  Where-Object { $_.Properties[8].Value -eq 3 -and $_.Properties[14].Value -eq "NTLM" }
```

## Sigma Rules

```yaml
title: PsExec Service Installation
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ServiceName|contains: 'PSEXE'
  condition: selection
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `LogonType 3` | Network logon (SMB, WMI) | PsExec, WMI |
| `LogonType 10` | Remote Interactive (RDP) | RDP sessions |
| `LogonType 9` | NewCredentials | runas /netonly |
| `NtLmSsp` | NTLM auth process | Pass-the-hash |
| `Event 7045` | Service installation | PsExec pattern |
| `Event 4648` | Explicit credential use | RDP with saved creds |
