Lateral Movement Detection
This query identifies potential lateral movement activities by detecting remote connections and credential usage patterns across multiple hosts.
#event_simpleName=NetworkConnect
| (RemotePort=445 OR RemotePort=3389 OR RemotePort=5985)
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])
| join({#event_simpleName=ProcessRollup2}, field=[aid, RawProcessId], include=[ImageFileName, CommandLine])
| join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])
| table([aid, UserName, ImageFileName, RemoteAddressIP4, RemotePort, CommandLine])This query uses CrowdStrike Query Language (CQL) to detect lateral movement activities:
-
Network Connections:
#event_simpleName=NetworkConnect- Monitors outbound network connections from endpoints -
Target Ports:
(RemotePort=445 OR RemotePort=3389 OR RemotePort=5985)- Focuses on SMB (445), RDP (3389), and WinRM (5985) connections -
External Targets:
!cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])- Excludes internal network ranges to focus on external connections -
Process Context:
join({#event_simpleName=ProcessRollup2}, field=[aid, RawProcessId], include=[ImageFileName, CommandLine])- Adds process information for the connecting application -
User Context:
join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])- Enriches with user account information -
Output:
table([aid, UserName, ImageFileName, RemoteAddressIP4, RemotePort, CommandLine])- Shows user, process, target IP, and connection details
