Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Detecting Lateral Movement with Splunk · mukul975 | DecimalAI

Detecting Lateral Movement With Splunk

SkillScore14Maintained

detecting-lateral-movement-with-splunk

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/detecting-lateral-movement-with-splunk/SKILL.md

decimalai skills pull detecting-lateral-movement-with-splunk --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/detecting-lateral-movement-with-splunk/SKILL.md https://app.decimal.ai/s/detecting-lateral-movement-with-splunk/SKILL.md

Raw file: /s/detecting-lateral-movement-with-splunk/SKILL.md ↗ · machine-readable summary at /s/detecting-lateral-movement-with-splunk.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

—+60% tokens0% turns14% of whole cases pass with skill (3/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	—	—
case-20	✗→✓	▲ Improved	—	—
case-14	✓→✓	＝ Same ✓	—	—
case-02	✗→✗	＝ Same ✗	—	—
case-21	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/detecting-lateral-movement-with-splunk/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Detecting Lateral Movement with Splunk

When to Use

When hunting for adversary movement between compromised systems
After detecting credential theft to trace subsequent lateral activity
When investigating unusual authentication patterns across the network
During incident response to scope the breadth of compromise
When proactively hunting for TA0008 (Lateral Movement) techniques

Prerequisites

Splunk Enterprise or Splunk Cloud with Windows event data ingested
Windows Security Event Logs forwarded (4624, 4625, 4648, 4672, 4768, 4769)
Sysmon deployed for process creation and network connection data
Network flow data or firewall logs for SMB/RDP/WinRM correlation
Active Directory user and group membership reference data

Workflow

Define Lateral Movement Scope: Identify which lateral movement techniques to hunt (RDP, SMB/Admin Shares, WinRM, PsExec, WMI, DCOM, SSH).
Query Authentication Events: Use SPL to search for Type 3 (Network) and Type 10 (RemoteInteractive) logons across the environment.
Build Authentication Graphs: Map source-to-destination authentication relationships to identify unusual connection patterns.
Detect First-Time Relationships: Identify new source-destination pairs that have not been seen in the historical baseline.
Correlate with Process Activity: Link authentication events to subsequent process creation on destination hosts.
Identify Anomalous Patterns: Flag lateral movement to sensitive servers, unusual hours, service account misuse, or rapid multi-host access.
Report and Contain: Document lateral movement path, affected systems, and coordinate containment response.

Key Concepts

| Concept | Description | |---------|-------------| | T1021 | Remote Services (parent technique) | | T1021.001 | Remote Desktop Protocol (RDP) | | T1021.002 | SMB/Windows Admin Shares | | T1021.003 | Distributed COM (DCOM) | | T1021.004 | SSH | | T1021.006 | Windows Remote Management (WinRM) | | T1570 | Lateral Tool Transfer | | T1047 | Windows Management Instrumentation | | T1569.002 | Service Execution (PsExec) | | Logon Type 3 | Network logon (SMB, WinRM, mapped drives) | | Logon Type 10 | Remote Interactive (RDP) | | Event ID 4624 | Successful logon | | Event ID 4648 | Explicit credential logon (runas, PsExec) |

Tools & Systems

| Tool | Purpose | |------|---------| | Splunk Enterprise | SIEM for log aggregation and SPL queries | | Splunk Enterprise Security | Threat detection and notable events | | Windows Event Forwarding | Centralize Windows logs | | Sysmon | Detailed process and network telemetry | | BloodHound | AD attack path analysis | | PingCastle | AD security assessment |

Common Scenarios

PsExec Lateral Movement: Adversary uses PsExec to execute commands on remote systems via SMB, generating Type 3 logon with ADMIN$ share access.
RDP Pivoting: Attacker RDPs to internal systems using stolen credentials, creating Type 10 logon events.
WMI Remote Execution: Adversary uses WMIC process call create to spawn processes on remote hosts.
WinRM PowerShell Remoting: Attacker uses Enter-PSSession or Invoke-Command to execute code on remote systems.
Pass-the-Hash via SMB: Compromised NTLM hashes used to authenticate to remote systems without knowing the plaintext password.

Output Format

Hunt ID: TH-LATMOV-[DATE]-[SEQ]
Movement Type: [RDP/SMB/WinRM/WMI/DCOM/PsExec]
Source Host: [Hostname/IP]
Destination Host: [Hostname/IP]
Account Used: [Username]
Logon Type: [3/10/other]
First Seen: [Timestamp]
Event Count: [Number of events]
Risk Level: [Critical/High/Medium/Low]
Lateral Movement Path: [A -> B -> C -> D]

Illustrative Want to see what detecting-lateral-movement-with-splunk would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 01:51 UTC · 22 cases

Measured on 21 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+9%

14% vs 5%

Agent turns

1.0 vs 1.0

Tokens

+60%

2,183.14 vs 1,361.67

fail → pass · 2pass → pass · 1fail → fail · 19

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-02 Our SIEM generated alerts indicating potential PowerShell remoting and WMI execution originating from host WS-04 toward database servers. Please conduct a lateral movement investigation in Splunk based on this incident. I need a structured report that specifies the hunt tracking ID, movement method, origin and target host identifiers, compromised user identity, logon classification, earliest observed timestamp, total event count, assigned severity rating, and the step-by-step movement chain across systems.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Our AWS CloudTrail logs show that an IAM user assumed an administrative role from an unapproved IP address. Conduct an IAM privilege policy evaluation and review the JSON policy document to identify overly permissive wildcard actions.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 We are categorizing detected WinRM PowerShell remoting lateral movement in Splunk into MITRE ATT&CK sub-techniques. While RDP maps to T1021.001 and SMB maps to T1021.002, which T1021 sub-technique ID represents Windows Remote Management?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 During a local workstation triage on host HR-DESK-09, we extracted local registry hives (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) and scheduled tasks. Analyze these local artifacts to identify persistence mechanisms established on this single machine.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 During a threat hunt following credential dumping on workstation MKTG-PC01, we want to trace secondary connections across internal subnets using our Splunk telemetry. Provide a hunt summary detailing the tracking hunt reference, protocol/technique involved, source host, destination host, target account, logon type classification, first seen timestamp, count of matching log entries, risk level, and the directional system-to-system path.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 A security team wants to structure their lateral movement hunting procedure in Splunk following standard guidelines. Before querying authentication logs or building graph models, what is the mandatory initial step of the workflow?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 An analyst is querying Windows Event ID 4624 in Splunk to detect Remote Desktop Protocol sessions. Junior analysts sometimes confuse network logons (type 3) or interactive logons (type 2) with RDP logons. What is the standard Windows logon type number generated by RDP connections?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When analyzing Active Directory attack paths and identity relationships alongside Splunk authentication logs, which specialized open-source AD graph security tool is referenced for path analysis?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 An investigator wants to identify WinRM lateral movement in process and command-line logs within Splunk. Which two common PowerShell remoting cmdlets indicate interactive or batch code execution on remote targets?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 While Windows Security logs provide logon events like 4624, what supplementary host security tool is listed in standard prerequisites for detailed process creation and network connection endpoint telemetry?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 In the lateral movement detection workflow using Splunk, after identifying new source-destination authentication pairs (first-time relationships), what is the next sequential step before flagging anomalous patterns?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 To perform lateral movement detection in Splunk, we need to ensure our Windows Security log forwarders collect the essential authentication and Kerberos event IDs. Aside from logon events 4624 and 4625, which Kerberos event IDs tracking TGT and Service Ticket requests must be forwarded?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We recently flagged suspicious activity on our domain where user jdoe seems to be jumping between several internal workstations. Please analyze our Splunk logs to trace potential internal propagation. Output your findings formatted with a unique hunt identifier, movement vector, source and destination hostnames, account used, logon category code, initial detection timestamp, total log event count, overall risk tier, and the complete multi-system traversal path.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 An investigator detects lateral movement via Distributed COM object interaction (like MMC20.Application or ShellWindows) in Windows telemetry. Which MITRE ATT&CK sub-technique ID specifically designates DCOM under Remote Services?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 An analyst is building SPL queries in Splunk to spot unauthorized lateral movement. Rather than looking only at failed logons, what analytical approach isolates never-before-seen connection pairs between source and destination hosts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 When searching Splunk for lateral tool execution where an attacker explicitly uses secondary credentials (such as runas or PsExec remote execution), which Windows Security Event ID specifically records logons attempted using explicit credentials?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 When analyzing Windows Security log event 4624 in Splunk for mapped network drives or SMB administrative share connections, security analysts often debate whether remote desktop interactive logons share the same logon type code. What specific numeric Windows logon type code corresponds to network logons over SMB and WinRM?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 When threat hunting for PsExec activity in Windows event logs aggregated in Splunk, an analyst expects to see network logons accessing default administrative shares. Which specific hidden administrative share is primary to PsExec service deployment and execution?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 When mapping PsExec-based lateral movement beyond generic Remote Services (T1021), which MITRE ATT&CK sub-technique ID specifically corresponds to Service Execution used by PsExec?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 A threat hunter identifies remote command invocation using WMI (`wmic /node:... process call create`). Which primary MITRE ATT&CK technique ID corresponds to Windows Management Instrumentation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 When an attacker copies executable binaries or tools across network shares from host A to host B prior to execution, which MITRE ATT&CK technique ID categorizes this tool transfer behavior?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We received an alert regarding a suspicious inbound email containing a malicious PDF attachment sent to executive staff. Please analyze the raw RFC 5322 email headers and DKIM/SPF alignment results to determine sender authenticity and spoofing risk.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +9 percentage points is the difference between those two pass rates over the 21 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 13.6%
Cases attempted: 22
Cases counted toward lift: 21
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 01:51 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run14

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-12% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.