Browse Rules

Malicious Remote File Creation

Malicious remote file creation, which can be an indicator of lateral movement activity.

Lateral Movement Alerts from a Newly Observed Source Address

This rule detects source IPs that triggered their first lateral movement alert within the last 10 minutes (i.e., newly observed), while also triggering at least 2 distinct lateral movement detection rules. This surfaces new potentially malicious IPs exhibiting immediate lateral movement behavior.

Unusual Remote File Extension

An anomaly detection job has detected a remote file transfer with a rare extension, which could indicate potential lateral movement activity on the host.

Lateral Movement Alerts from a Newly Observed User

This rule detects multiple lateral movement alerts from a user that was observed for the first time in the previous 5 days of alerts history. Analysts can use this high-order detection to prioritize triage and response.

Service Command Lateral Movement

Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.

WMI Incoming Lateral Movement

Identifies processes executed via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement, but could be noisy if administrators use WMI to remotely manage hosts.

At.exe Command Lateral Movement

Identifies use of at.exe to interact with the task scheduler on remote hosts. Remote task creations, modifications or execution could be indicative of adversary lateral movement.

Unusual Remote File Directory

An anomaly detection job has detected a remote file transfer on an unusual directory indicating a potential lateral movement activity on the host. Many Security solutions monitor well-known directories for suspicious activities, so attackers might use less common directories to bypass monitoring.

High Mean of RDP Session Duration

A machine learning job has detected unusually high mean of RDP session duration. Long RDP sessions can be used to evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might require uninterrupted access to a compromised machine.

High Variance in RDP Session Duration

A machine learning job has detected unusually high variance of RDP session duration. Long RDP sessions can be used to evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might require uninterrupted access to a compromised machine.

Remote Scheduled Task Creation via RPC

Identifies scheduled task creation from a remote source. This could be indicative of adversary lateral movement.

PsExec Network Connection

Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement.

Deprecated - PowerShell Script with Remote Execution Capabilities via WinRM

Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools.

Remote Scheduled Task Creation

Identifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement.

Spike in Number of Processes in an RDP Session

A machine learning job has detected unusually high number of processes started in a single RDP session. Executing a large number of processes remotely on other machines can be an indicator of lateral movement activity.

Potential SharpRDP Behavior

Identifies potential behavior of SharpRDP, which is a tool that can be used to perform authenticated command execution against a remote target via Remote Desktop Protocol (RDP) for the purposes of lateral movement.

Remote SSH Login Enabled via systemsetup Command

Detects use of the systemsetup command to enable remote SSH Login.

High Mean of Process Arguments in an RDP Session

A machine learning job has detected unusually high number of process arguments in an RDP session. Executing sophisticated attacks such as lateral movement can involve the use of complex commands, obfuscation mechanisms, redirection and piping, which in turn increases the number of arguments in a command.

Unusual Process For MSSQL Service Accounts

Identifies unusual process executions using MSSQL Service accounts, which can indicate the exploitation/compromise of SQL instances. Attackers may exploit exposed MSSQL instances for initial access or lateral movement.

Remote Execution via File Shares

Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares.

Incoming DCOM Lateral Movement with MMC

Identifies the use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the MMC20 Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally.

Incoming DCOM Lateral Movement via MSHTA

Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally while attempting to evade detection.

Spike in Number of Connections Made to a Destination IP

A machine learning job has detected a high count of source IPs establishing an RDP connection with a single destination IP. Attackers might use multiple compromised systems to attack a target to ensure redundancy in case a source IP gets detected and blocked.

Remote File Creation in World Writeable Directory

This rule detects the creation of a file in a world-writeable directory through a service that is commonly used for file transfer. This behavior is often associated with lateral movement and can be an indicator of an attacker attempting to move laterally within a network.

Suspicious Curl to Jamf Endpoint

Detects curl requests to JAMF Pro endpoints from suspicious processes like unsigned binaries or scripting interpreters. This indicates potential abuse of stolen JAMF credentials for lateral movement in enterprise macOS environments.