Skills tagged "lateral-movement"

detecting-lateral-movement-in-network - Detect Lateral Movement in Enterprise Networks
network-security lateral-movement threat-detection siem
★ 0 · Updated 2026-10-02
Identifies lateral movement by analyzing authentication logs, network flows, SMB traffic, and RDP sessions with Zeek, Velociraptor, and SIEM rules.
⚙ Analyze authentication logs ⚙ Correlate SIEM events ⚙ Detect SMB movement
Red Team Operations & Engagement Planning - Plan authorized red team engagements and operations
cybersecurity red-team c2 lateral-movement
★ 0 · Updated 2026-09-29
Assists authorized red team operators with engagement planning, C2 design, attack methodology, OPSEC, collaboration, and reporting.
⚙ Plan red team engagements ⚙ Design C2 architectures ⚙ Guide authorized AD methods
detecting-lateral-movement-with-zeek - Detecting Lateral Movement with Zeek
zeek lateral-movement smb dce-rpc
★ 0 · Updated 2026-09-19
Detect lateral movement in network traffic by analyzing Zeek logs to identify SMB transfers, NTLM spray, remote service execution, and connection anomalies.
⚙ Verify Zeek log collection ⚙ Parse conn.log for lateral patterns ⚙ Analyze SMB admin share access
detecting-lateral-movement-with-zeek - Detect Lateral Movement with Zeek
zeek lateral-movement smb dce-rpc
★ 1 · Updated 2026-09-19
Parses Zeek logs to detect SMB admin share access, DCE/RPC remote service execution, NTLM account spray, and anomalous internal connections.
⚙ Parse Zeek network logs ⚙ Analyze SMB admin share access ⚙ Detect DCE RPC service operations
detecting-lateral-movement-with-zeek - Detect lateral movement in network traffic using Zeek logs.
zeek lateral-movement smb dce-rpc
★ 0 · Updated 2026-09-19
Parses Zeek logs to identify SMB file transfers, NTLM account spray, remote service execution, and anomalous internal connections.
⚙ Parse Zeek network logs ⚙ Detect SMB admin share access ⚙ Identify DCE RPC service operations
detecting-lateral-movement-with-zeek - Detecting Lateral Movement with Zeek
zeek lateral-movement smb dce-rpc
★ 0 · Updated 2026-09-19
Analyze Zeek network logs to detect lateral movement including SMB share access, DCE/RPC service execution, and NTLM account spray.
⚙ Verify Zeek log collection ⚙ Parse conn.log for lateral connections ⚙ Analyze SMB admin share access
implementing-siem-correlation-rules-for-apt - Implement SIEM correlation rules for APT lateral movement.
siem correlation-rules apt-detection lateral-movement
★ 0 · Updated 2026-09-12
Build multi-event correlation rules using Splunk SPL and Sigma to detect APT lateral movement across Windows systems.
⚙ Connect to Splunk REST API ⚙ Build Sigma correlation rules ⚙ Convert Sigma rules to SPL
implementing-siem-correlation-rules-for-apt - Implementing SIEM Correlation Rules for APT
siem correlation-rules apt-detection lateral-movement
★ 1 · Updated 2026-09-12
Build multi-event correlation rules using Splunk SPL and Sigma to detect APT lateral movement across Windows event logs and Sysmon telemetry.
⚙ Build multi-step Sigma correlation rules ⚙ Convert Sigma rules to Splunk SPL ⚙ Deploy correlation searches to Splunk ES
moving-laterally-with-netexec - Lateral Movement with NetExec for Penetration Testing
netexec lateral-movement smb password-spraying
★ 72 · Updated 2026-06-30
Use NetExec to enumerate SMB, WinRM, LDAP, and MSSQL services, spray passwords, execute commands, and dump credentials on authorized targets.
⚙ validate credentials across hosts ⚙ enumerate SMB shares and users ⚙ enumerate password policy via LDAP
moving-laterally-with-netexec - NetExec Network Penetration Testing
netexec penetration-testing lateral-movement smb
★ 33,949 · Updated 2026-06-30
NetExec tool for SMB, WinRM, LDAP, MSSQL enumeration and remote execution
⚙ enumerate SMB shares ⚙ enumerate domain users ⚙ enumerate password policy
T1550.001_application-access-token - Use stolen application access tokens for authentication bypass
mitre-attack enterprise defense-evasion lateral-movement
★ 3,096 · Updated 2026-05-28
Use stolen application access tokens to bypass authentication and access restricted accounts, information, or services.
⚙ steal application access tokens ⚙ bypass authentication process ⚙ access restricted accounts