<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Detecting Lateral Movement Before Deployment — API Reference

## Windows Event IDs

| Event ID | Log | Lateral Movement Indicator |
|----------|-----|--------------------------|
| 4624 | Security | Logon event (Type 10 = RDP, Type 3 = Network) |
| 4648 | Security | Explicit credential logon (runas, PsExec) |
| 4672 | Security | Special privileges assigned (admin logon) |
| 5140 | Security | Network share accessed (ADMIN$, C$) |
| 5145 | Security | Detailed share access with permissions |
| 7045 | System | Service installation (PsExec, ransomware) |
| 4688 | Security | Process creation (WMI child, WinRM) |
| 5136 | Security | Directory service object modified (GPO) |

## Sysmon Event IDs

| Event ID | Description | Lateral Use |
|----------|-------------|------------|
| 1 | Process creation | PsExec, WMI, WinRM child processes |
| 3 | Network connection | SMB, WinRM, RDP connections |
| 17/18 | Pipe created/connected | PsExec named pipes |
| 13 | Registry modification | GPO changes |

## Zeek Analysis

```bash
# SMB lateral movement
zeek-cut ts id.orig_h id.resp_h < conn.log | \
  grep smb | sort | uniq -c | sort -rn

# WinRM connections (5985/5986)
zeek-cut ts id.orig_h id.resp_h id.resp_p < conn.log | \
  awk '$4==5985||$4==5986'

# RDP connections (3389)
zeek-cut ts id.orig_h id.resp_h id.resp_p < conn.log | \
  awk '$4==3389' | sort | uniq -c | sort -rn
```

## CrowdStrike Falcon API

```bash
# Search for lateral movement indicators
curl -s "https://api.crowdstrike.com/detects/queries/detects/v1?filter=behaviors.tactic:'Lateral Movement'" \
  -H "Authorization: Bearer $CS_TOKEN"
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `rdp_threshold` | Max unique RDP targets per hour | `3` |
| `smb_shares` | Admin shares to monitor | `ADMIN$, C$` |
| `winrm_ports` | WinRM service ports | `5985, 5986` |
| `log_path` | Event log directory | `/var/log/evtx/` |
