Lateral Movement Detection Hunt (Example: PsExec/WMI)

Objective

Proactively hunt for signs of lateral movement using common administrative tools like PsExec or WMI abuse, which attackers often leverage.

Scope

This runbook provides a template for hunting specific lateral movement TTPs, focusing on PsExec and WMI examples using SIEM queries.

Inputs

• ${TIME_FRAME_HOURS}: Lookback period in hours for SIEM searches (default: 72).
• (Optional) ${TARGET_SCOPE_QUERY}: A UDM query fragment to narrow the scope (e.g., principal.hostname = "server1" or target.hostname = "domain_controller").
• (Optional) ${HUNT_HYPOTHESIS}: Brief description of the reason for the hunt (e.g., "Hunting for PsExec usage originating from non-admin workstations").

Tools

• secops-mcp: get_threat_intel (for technique understanding), search_security_events (core hunting tool), lookup_entity (for enriching findings).
• secops-soar: post_case_comment (for documenting hunt/findings), list_cases (optional, check related cases).
• gti-mcp: (Used for enriching findings if IOCs are discovered).
• (Optional: Identity Provider tools like okta-mcp.lookup_okta_user)
• Common Steps: skills/common/find-relevant-soar-case/SKILL.md

Workflow Steps & Diagram

1. Receive Input & Define Scope: Obtain ${TIME_FRAME_HOURS}, optionally ${TARGET_SCOPE_QUERY} and ${HUNT_HYPOTHESIS}.
2. Research Techniques (SIEM/External):
   • Use secops-mcp_get_threat_intel for TTPs like T1570 (Lateral Tool Transfer - PsExec often copied), T1021.002 (Remote Services: SMB/Windows Admin Shares - PsExec uses this), T1047 (Windows Management Instrumentation - WMI abuse).
   • (Manual Step: Review MITRE ATT&CK website for detailed procedures and detection guidance for these techniques).
3. Develop SIEM Hunt Queries:
   • Based on research, formulate specific secops-mcp_search_security_events UDM queries targeting indicators. Examples:
     • PsExec Service Installation: metadata.product_event_type = "ServiceInstalled" AND target.process.file.full_path CONTAINS "PSEXESVC.exe" (Requires appropriate Windows Event Log source - System Log Event ID 7045).
     • PsExec Execution (Indirect): Look for services.exe spawning unusual processes, especially on remote machines shortly after potential SMB connection. metadata.event_type = "PROCESS_LAUNCH" AND principal.process.file.full_path = "C:\Windows\System32\services.exe" AND target.process.file.full_path NOT IN ("standard_service_process1.exe", "standard_service_process2.exe") (Needs significant tuning based on environment).
     • WMI Process Creation: metadata.event_type = "PROCESS_LAUNCH" AND principal.process.file.full_path = "C:\Windows\System32\wbem\WmiPrvSE.exe" (Look for WmiPrvSE.exe spawning suspicious child processes like cmd.exe, powershell.exe).
     • WMI Command-Line Execution: metadata.event_type = "PROCESS_LAUNCH" AND principal.process.file.full_path = "C:\Windows\System32\cmd.exe" AND principal.process.command_line CONTAINS "wmic" AND principal.process.command_line CONTAINS "/node:" AND principal.process.command_line CONTAINS "process call create"
     • WMI Event Subscription (Persistence T1546.003): Search for events related to __EventFilter, __EventConsumer, __FilterToConsumerBinding creation/modification (Requires specific WMI event logging or EDR visibility). Example: metadata.event_type = "WMI_ACTIVITY" AND description CONTAINS "__EventFilter"
     • PowerShell WMI Methods: Search for PowerShell scripts (.ps1) or command lines using Invoke-WmiMethod, Get-WmiObject, or Invoke-CimMethod for remote interaction. Example: metadata.event_type = "PROCESS_LAUNCH" AND target.process.file.full_path CONTAINS "powershell.exe" AND target.process.command_line CONTAINS "Invoke-WmiMethod"
   • Combine technique-specific queries with ${TARGET_SCOPE_QUERY} if provided.
4. Execute SIEM Searches:
   • Run the developed queries using secops-mcp_search_security_events with hours_back=${TIME_FRAME_HOURS}.
5. Network Correlation (Optional but Recommended):
   • If suspicious process activity is found on a target host, search for corresponding network connections (especially SMB port 445) originating from potential source hosts around the same time.
   • Example Query: metadata.event_type = "NETWORK_CONNECTION" AND target.port = 445 AND target.ip = "TARGET_IP" AND principal.ip = "SOURCE_IP" (Adjust IPs and timeframe based on findings).
6. Analyze Results:
   • Review results for anomalous patterns: PsExec/WMI usage originating from unexpected sources (e.g., user workstations instead of admin servers), execution targeting a large number of hosts, execution of suspicious commands via WMI, correlation between network connections and remote process execution.
7. Enrich Findings:
   • If suspicious activity is found: * Use secops-mcp_lookup_entity for involved source/destination hosts, users. Let these be SUSPICIOUS_ENTITIES. * (Optional) If an Identity Provider tool is available (e.g., okta-mcp.lookup_okta_user), gather context on involved user accounts. * Use gti-mcp tools to enrich any associated IPs, domains, or hashes if applicable. Let combined enrichment be ENRICHMENT_RESULTS.
8. Check Related SOAR Cases:
   • If SUSPICIOUS_ENTITIES were identified:
     • Execute skills/common/find-relevant-soar-case/SKILL.md with SEARCH_TERMS=SUSPICIOUS_ENTITIES and CASE_STATUS_FILTER="Opened".
     • Obtain ${RELATED_SOAR_CASES} (list of potentially relevant open case summaries/IDs).
9. Document Hunt & Findings:
   • Use soar-mcp_post_case_comment in a dedicated hunting case or relevant existing case.
   • Document: Hunt Hypothesis/Objective, Techniques Hunted, Scope, Timeframe, Queries Used, Summary of Findings (explicitly noting queries with negative results), Details of suspicious activity, Enrichment results (ENRICHMENT_RESULTS), Related SOAR Cases (${RELATED_SOAR_CASES}).
   • Suggest Follow-on Actions: Based on findings, suggest next steps like triggering case_event_timeline_and_process_analysis.md for suspicious processes or compromised_user_account_response.md for involved users.
10. Escalate or Conclude:
    • If confirmed lateral movement or tool abuse is found, escalate by creating a new incident case or linking findings to an existing one.
    • If no significant findings, conclude the hunt and document it thoroughly.
11. Completion: Conclude the runbook execution.

ADK Graph-Based Workflow Diagram

graph TD
    START(["START"]) --> extract_lat_move_payload_node["1. extract_lat_move_payload_node<br/><i>(Extract Hunt Scope Payload)</i>"]
    extract_lat_move_payload_node --> search_psexec_wmi_events_node["2. search_psexec_wmi_events_node<br/><i>(Search PsExec & WMI Remote Events)</i>"]
    search_psexec_wmi_events_node --> lateral_movement_router{"3. lateral_movement_router<br/><i>(Event.actions.route)</i>"}

    lateral_movement_router -- "HIGH_LATERAL_MOVEMENT" --> handle_high_lateral_movement_branch["4a. handle_high_lateral_movement_branch<br/><i>(Isolate Source & Target Hosts)</i>"]
    lateral_movement_router -- "CLEAN_HUNT" --> handle_clean_lateral_hunt_branch["4b. handle_clean_lateral_hunt_branch<br/><i>(Document Clean Hunt Outcome)</i>"]

    handle_high_lateral_movement_branch --> document_lateral_report_node["5. document_lateral_report_node<br/><i>(SOAR Comment & Report Summary)</i>"]
    handle_clean_lateral_hunt_branch --> document_lateral_report_node

Sequence Diagram

sequenceDiagram
    participant Analyst
    participant AutomatedAgent as Automated Agent (MCP Client)
    participant SecOpsMCP as secops-mcp
    participant SOAR as secops-soar
    participant MITRE as MITRE ATT&CK (External)
    participant IDP as Identity Provider (Optional)
    participant GTI as gti-mcp
    participant FindCase as skills/common/find-relevant-soar-case/SKILL.md

    Analyst->>AutomatedAgent: Start Lateral Movement Hunt (PsExec/WMI)\nInput: TIME_FRAME_HOURS, TARGET_SCOPE_QUERY (opt), HUNT_HYPOTHESIS (opt)

    %% Step 2: Research Techniques
    AutomatedAgent->>SecOpsMCP: get_threat_intel(query="MITRE T1021.002")
    SecOpsMCP-->>AutomatedAgent: Technique Context
    AutomatedAgent->>SecOpsMCP: get_threat_intel(query="MITRE T1047")
    SecOpsMCP-->>AutomatedAgent: Technique Context
    AutomatedAgent->>MITRE: (Manual) Review ATT&CK Website
    MITRE-->>AutomatedAgent: Detailed Procedures/Detections

    %% Step 3: Develop SIEM Queries
    Note over AutomatedAgent: Formulate UDM queries for PsExec/WMI indicators (incl. new WMI examples)

    %% Step 4: Execute SIEM Searches
    loop For each developed Query Qi
        AutomatedAgent->>SecOpsMCP: search_security_events(text=Qi, hours_back=TIME_FRAME_HOURS)
        SecOpsMCP-->>AutomatedAgent: Search Results for Qi
    end

    %% Step 5: Network Correlation (Optional)
    opt Suspicious Activity Found
        Note over AutomatedAgent: Construct Network Correlation Query Qn
        AutomatedAgent->>SecOpsMCP: search_security_events(text=Qn, hours_back=...)
        SecOpsMCP-->>AutomatedAgent: Network Correlation Results
    end

    %% Step 6: Analyze Results
    Note over AutomatedAgent: Analyze results for anomalous PsExec/WMI usage & correlations

    %% Step 7: Enrich Findings
    opt Suspicious Activity Found
        Note over AutomatedAgent: Identify SUSPICIOUS_ENTITIES (H1, U1...)
        loop For each Suspicious Entity Ei
            AutomatedAgent->>SecOpsMCP: lookup_entity(entity_value=Ei)
            SecOpsMCP-->>AutomatedAgent: SIEM Summary for Ei
            opt IDP Tool Available and Ei is User
                AutomatedAgent->>IDP: lookup_user(user=Ei)
                IDP-->>AutomatedAgent: User IDP Context
            end
            %% Potentially enrich related IOCs if found
            opt IOCs Found (I1, I2...)
                 loop For each IOC Ii
                     AutomatedAgent->>GTI: get_..._report(ioc=Ii)
                     GTI-->>AutomatedAgent: GTI Report for Ii
                 end
            end
        end
        Note over AutomatedAgent: Store combined enrichment (ENRICHMENT_RESULTS)
    end

    %% Step 8: Check Related SOAR Cases
    opt Suspicious Activity Found
        AutomatedAgent->>FindCase: Execute(Input: SEARCH_TERMS=SUSPICIOUS_ENTITIES, CASE_STATUS_FILTER="Opened")
        FindCase-->>AutomatedAgent: Results: RELATED_SOAR_CASES
    end

    %% Step 9: Document Hunt
    Note over AutomatedAgent: Prepare hunt summary comment (incl. negative results, related cases & suggested follow-ons)
    AutomatedAgent->>SOAR: post_case_comment(case_id=[Hunt Case/Relevant Case], comment="Lateral Movement Hunt (PsExec/WMI) Summary: Scope [...], Queries [...], Findings [...], Enrichment [...], Related Cases: [...], Follow-on: [...]")
    SOAR-->>AutomatedAgent: Comment Confirmation

    %% Step 10 & 11: Escalate or Conclude
    alt Confirmed Malicious Activity Found
        Note over AutomatedAgent: Escalate findings (Create new case or link to existing)
        AutomatedAgent->>Analyst: attempt_completion(result="Lateral Movement Hunt complete. Findings escalated.")
    else No Significant Findings
        AutomatedAgent->>Analyst: attempt_completion(result="Lateral Movement Hunt complete. No significant findings. Hunt documented.")
    end

## Rubrics

The following rubric is used to evaluate the execution of this **Threat Hunt/Analysis** runbook by an LLM agent.

### Grading Scale (0-100 Points)

| Criteria | Points | Description |
| :--- | :--- | :--- |
| **Scope & Query** | 25 | Defined a clear scope and executed effective queries (UDM, search). |
| **Data Analysis** | 30 | Analyzed results to identify patterns, anomalies, or malicious behavior. |
| **Findings** | 15 | Accurately identified and filtered findings (True Positives vs. False Positives). |
| **Documentation** | 15 | Documented the hunt methodology and results clearly. |
| **Operational Artifacts** | 15 | Produced required artifacts: Sequence diagram, execution metadata (date/cost), and summary. |

### Evaluation Criteria Details

#### 1. Scope & Query (25 Points)
- **10 pts**: Correctly defined the time range and entities/indicators for the hunt.
- **15 pts**: Constructed and executed valid, efficient queries to retrieve relevant data.

#### 2. Data Analysis (30 Points)
- **15 pts**: Effectively analyzed the returned data for the hypothesized threat.
- **15 pts**: Correlated events or indicators to strengthen the analysis.

#### 3. Findings (15 Points)
- **15 pts**: Correctly classified the findings and provided evidence for the conclusion.

#### 4. Documentation (15 Points)
- **15 pts**: Recorded the hunt process, queries used, and findings in the system of record.

#### 5. Operational Artifacts (15 Points)
- **5 pts**: **Sequence Diagram**: Produced a Mermaid sequence diagram visualizing the steps taken.
- **5 pts**: **Execution Metadata**: Recorded the date, duration, and estimated token cost.
- **5 pts**: **Summary Report**: Generated a concise summary of the actions and outcomes.