domains / families / security / detecting-lateral-movement-with-splunk

detecting-lateral-movement-with-splunk

separate

Detect adversary lateral movement across networks using Splunk SPL queries

When to use

• When hunting for adversary movement between compromised systems
• After detecting credential theft to trace subsequent lateral activity
• When investigating unusual authentication patterns across the network
• During incident response to scope the breadth of compromise
• When proactively hunting for TA0008 (Lateral Movement) techniques

Skill page

Source