Detecting Lateral Movement: SMB, WMI, RDP and Remote Execution

After initial access, attackers pivot with SMB, WMI, RDP and remote service execution — often via Impacket (wmiexec/psexec/smbexec) and pass-the-hash. This pack lists the Windows events and behaviours that reveal it. Lateral movement uses valid credentials, so detection is behavioural: unusual source-to-destination admin access, remote execution, and credential reuse.

Signals at a Glance

Remote Execution

The clearest signals are a service appearing on a target (PsExec) and a remote WMI process create (wmiexec). Alert on service installs with random or odd names and on wmiprvse.exe spawning cmd.exe/powershell.exe:

title: Potential wmiexec Remote Execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    cmd:
        CommandLine|contains: '\127.0.0.1\ADMIN$'   # output redirect artifact
    condition: selection and cmd
level: high

Access Patterns

• Build a baseline of which hosts legitimately perform admin logons to which, then alert on new source-to-destination admin access (4624 type 3 with privileged accounts) and on a workstation using explicit credentials (4648) to reach servers.
• Hunt for the Impacket wmiexec output artifact — a file in the target’s ADMIN$ named with an epoch timestamp — and for RDP (type 10) from hosts that do not normally initiate it.
• Detect pass-the-hash by correlating NTLM network logons with accounts that should use Kerberos, and watch LSASS access for credential theft that precedes reuse.