Anthropic-Cybersecurity-Skills/skills/detecting-lateral-movement-with-splunk/assets/template.md

Lateral Movement Hunt Template

Hunt Metadata

Field	Value
Hunt ID	TH-LATMOV-YYYY-MM-DD-NNN
Analyst
Date
Status	[ ] In Progress / [ ] Complete

Hypothesis

[e.g., "Adversaries are moving laterally via SMB admin shares using compromised domain admin credentials."]

Techniques Investigated

• T1021.001 - RDP
• T1021.002 - SMB/Admin Shares
• T1021.006 - WinRM
• T1047 - WMI
• T1569.002 - PsExec/Service Execution
• T1550.002 - Pass the Hash
• T1570 - Lateral Tool Transfer

Lateral Movement Path Map

[Source A] --RDP--> [Host B] --SMB--> [Host C] --WMI--> [Host D]
     |                                    |
     +--PsExec--> [Host E]               +--WinRM--> [Server F]

Findings

#	Source	Destination	Account	Method	Logon Type	Time	Risk
1

Affected Accounts

Account	Type	Hosts Accessed	Movement Method

Recommendations

1. Containment: [Isolate systems, disable accounts]
2. Credential Reset: [Scope of password resets needed]
3. Detection: [New rules for identified patterns]