agentsclimarketplace
Sign in

Hunting lateral movement over smb and wmi

Skill meltedinhex/analyst-ai-pack/skills/hunting-lateral-movement-over-smb-and-wmi

Hunts for lateral movement via remote service creation, admin share writes, and remote WMI process creation by correlating Windows logon, service install, and process-creation events. Activates for requests to hunt lateral movement, detect PsExec/WMIexec activity, or find remote execution over SMB and WMI.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-lateral-movement-over-smb-and-wmi

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 447 tokens by cl100k_base, as published. Nobody here has run it

Hunting Lateral Movement Over SMB and WMI

When to Use

  • You have Windows logon (4624), service install (7045/4697), and process-creation telemetry and want to detect remote execution tools (PsExec, WMIexec, SMBexec) moving between hosts.
  • You are reconstructing an attacker's east-west movement.

Do not use this to alert on all Type 3 logons — network logons are normal. Hunt the service-creation, admin-share, and remote-WMI patterns that accompany them.

Prerequisites

  • Logon (4624 Type 3), service install (7045/4697), and process-creation events.

Workflow

Step 1: Correlate remote-execution indicators

python scripts/analyst.py hunt events.csv

Flags PsExec-style service installs (PSEXESVC, randomly named services running from ADMIN$), remote WMI parents (wmiprvse.exe spawning cmd/powershell), and named-pipe service binaries.

Step 2: Build a movement graph

Group by source account and target host to see fan-out across systems.

Step 3: Confirm

Distinguish admin tooling from intrusion by account, timing, and target breadth.

Step 4: Operationalize

Write Sigma rules for PsExec service creation and wmiprvse.exe child shells.

Validation

  • Remote service installs are flagged by image path/name patterns, not service installs broadly.
  • wmiprvse.exe-parented shells are correlated with the originating account where possible.
  • Findings map to ATT&CK T1021.002/.003.

Pitfalls

  • Legitimate admin/management software using PsExec or remote WMI.
  • Renamed PsExec service binaries evading name checks.
  • Missing the logon-to-execution correlation across separate event sources.

References

What ships with it: 3 files

4.8 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.