title: PsExec Service Installation
id: c3f7a8d2-1b4e-4f6a-9d2c-8e7f5a3b6c1d
status: experimental
description: Detects PsExec service installation indicating lateral movement
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'psexec'
  condition: selection
falsepositives:
  - Legitimate admin use of PsExec with documented change ticket
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "wmiprvse.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "mshta.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine,
    InitiatingProcessCommandLine
| join kind=inner (
    DeviceLogonEvents
    | where LogonType == "Network"
    | where Timestamp > ago(24h)
) on DeviceName
| project Timestamp, DeviceName, RemoteIP, FileName, ProcessCommandLine

index=windows (EventCode=4624 Logon_Type=10)
| stats earliest(_time) as first_rdp, latest(_time) as last_rdp,
    dc(dest) as dest_count, values(dest) as destinations by src_ip, user
| where dest_count > 2
| eval first_rdp=strftime(first_rdp, "%Y-%m-%d %H:%M:%S")
| sort -dest_count

title: SMB Lateral Movement - Unusual Internal SMB Traffic
id: d4e8f9a1-2c5b-4d7e-8f3a-9b6c1d2e5f4a
status: experimental
description: Detects workstation-to-workstation SMB connections outside baseline
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 445
    Initiated: 'true'
  filter_servers:
    DestinationIp|cidr:
      - '10.0.1.0/24'
  condition: selection and not filter_servers
falsepositives:
  - Peer-to-peer file sharing in flat networks
level: medium
tags:
  - attack.lateral_movement
  - attack.t1021.002

// Detect chains: Host A -> Host B -> Host C
DeviceLogonEvents
| where Timestamp > ago(24h)
| where LogonType == "Network"
| project SourceHost = RemoteDeviceName, DestHost = DeviceName,
    User = AccountName, T = Timestamp
| join kind=inner (
    DeviceLogonEvents
    | where LogonType == "Network"
    | project SourceHost2 = RemoteDeviceName, DestHost2 = DeviceName,
        User2 = AccountName, T2 = Timestamp
) on $left.DestHost == $right.SourceHost2
| where T2 > T and datetime_diff('minute', T2, T) < 30
| where User == User2
| project T, User, Hop1_Src = SourceHost, Hop1_Dest = DestHost,
    Hop2_Dest = DestHost2