attack.lateral-movement — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Access To ADMIN$ Network Share · sigma-rule
• Admin User Remote Logon · sigma-rule
• Apache Threading Error · sigma-rule
• Audit CVE Event · sigma-rule
• AWS Console GetSigninToken Potential Abuse · sigma-rule
• AWS STS AssumeRole Misuse · sigma-rule
• AWS STS GetSessionToken Misuse · sigma-rule
• AWS Suspicious SAML Activity · sigma-rule
• BaaUpdate.exe Suspicious DLL Load · sigma-rule
• Bitbucket Global SSH Settings Changed · sigma-rule
• Bitbucket User Login Failure Via SSH · sigma-rule
• Cisco Stage Data · sigma-rule
• CobaltStrike Service Installations - Security · sigma-rule
• CobaltStrike Service Installations - System · sigma-rule
• Copy From Or To Admin Share Or Sysvol Folder · sigma-rule
• DCERPC SMB Spoolss Named Pipe · sigma-rule
• DCOM InternetExplorer.Application Iertutil DLL Hijack - Security · sigma-rule
• Denied Access To Remote Desktop · sigma-rule
• DNS Query Request By QuickAssist.EXE · sigma-rule
• Enable Windows Remote Management · sigma-rule
• Execute Invoke-command on Remote Host · sigma-rule
• External Disk Drive Or USB Storage Device Was Recognized By The System · sigma-rule
• First Time Seen Remote Named Pipe · sigma-rule
• First Time Seen Remote Named Pipe - Zeek · sigma-rule
• HackTool - KrbRelayUp Execution · sigma-rule
• HackTool - NetExec Execution · sigma-rule
• HackTool - NetExec File Indicators · sigma-rule
• HackTool - Potential Impacket Lateral Movement Activity · sigma-rule
• HackTool - Rubeus Execution · sigma-rule
• HackTool - Rubeus Execution - ScriptBlock · sigma-rule
• HackTool - SharpMove Tool Execution · sigma-rule
• HackTool - SharpWSUS/WSUSpendu Execution · sigma-rule
• HackTool - WinRM Access Via Evil-WinRM · sigma-rule
• Hacktool Ruler · sigma-rule
• Impacket PsExec Execution · sigma-rule
• Metasploit Or Impacket Service Installation Via SMB PsExec · sigma-rule
• Metasploit SMB Authentication · sigma-rule
• Mimikatz Use · sigma-rule
• MMC Spawning Windows Shell · sigma-rule
• MMC20 Lateral Movement · sigma-rule
• New Port Forwarding Rule Added Via Netsh.EXE · sigma-rule
• New PortProxy Registry Entry Added · sigma-rule
• New Remote Desktop Connection Initiated Via Mstsc.EXE · sigma-rule
• NTLM Logon · sigma-rule
• NTLMv1 Logon Between Client and Server · sigma-rule
• OpenCanary - FTP Login Attempt · sigma-rule
• OpenCanary - RDP New Connection Attempt · sigma-rule
• OpenCanary - SMB File Open Request · sigma-rule
• OpenCanary - SNMP OID Request · sigma-rule
• OpenCanary - SSH Login Attempt · sigma-rule
• OpenCanary - SSH New Connection Attempt · sigma-rule
• OpenCanary - VNC Connection Attempt · sigma-rule
• OpenEDR Spawning Command Shell · sigma-rule
• OpenSSH Server Listening On Socket · sigma-rule
• Outbound RDP Connections Over Non-Standard Tools · sigma-rule
• Outgoing Logon with New Credentials · sigma-rule
• Pass the Hash Activity 2 · sigma-rule
• Password Provided In Command Line Of Net.EXE · sigma-rule
• PDQ Deploy Remote Adminstartion Tool Execution · sigma-rule
• Persistence and Execution at Scale via GPO Scheduled Task · sigma-rule
• Port Forwarding Activity Via SSH.EXE · sigma-rule
• Potential CobaltStrike Service Installations - Registry · sigma-rule
• Potential DCOM InternetExplorer.Application DLL Hijack · sigma-rule
• Potential DCOM InternetExplorer.Application DLL Hijack - Image Load · sigma-rule
• Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp · sigma-rule
• Potential Lateral Movement via Windows Remote Shell · sigma-rule
• Potential MSTSC Shadowing Activity · sigma-rule
• Potential Persistence Via Logon Scripts - Registry · sigma-rule
• Potential Remote Desktop Tunneling · sigma-rule
• Potential Remote PowerShell Session Initiated · sigma-rule
• Potential Tampering With RDP Related Registry Keys Via Reg.EXE · sigma-rule
• Potentially Suspicious File Creation by OpenEDR's ITSMService · sigma-rule
• Privilege Escalation via Named Pipe Impersonation · sigma-rule
• Protected Storage Service Access · sigma-rule
• PSExec and WMI Process Creations Block · sigma-rule
• Psexec Execution · sigma-rule
• PSEXEC Remote Execution File Artefact · sigma-rule
• PUA - CSExec Default Named Pipe · sigma-rule
• PUA - Radmin Viewer Utility Execution · sigma-rule
• PUA - RemCom Default Named Pipe · sigma-rule
• Publicly Accessible RDP Service · sigma-rule
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class · sigma-rule
• RDP Login from Localhost · sigma-rule
• RDP Over Reverse SSH Tunnel · sigma-rule
• RDP over Reverse SSH Tunnel WFP · sigma-rule
• RDP Port Forwarding Rule Added Via Netsh.EXE · sigma-rule
• RDP to HTTP or HTTPS Target Ports · sigma-rule
• Register new Logon Process by Rubeus · sigma-rule
• Remote DCOM/WMI Lateral Movement · sigma-rule
• Remote File Copy · sigma-rule
• Remote LSASS Process Access Through Windows Remote Management · sigma-rule
• Remote PowerShell Session (PS Classic) · sigma-rule
• Remote PowerShell Session (PS Module) · sigma-rule
• Remote PowerShell Session Host Process (WinRM) · sigma-rule
• Remote Registry Lateral Movement · sigma-rule
• Remote Schedule Task Lateral Movement via ATSvc · sigma-rule
• Remote Schedule Task Lateral Movement via ITaskSchedulerService · sigma-rule
• Remote Schedule Task Lateral Movement via SASec · sigma-rule
• Remote Server Service Abuse for Lateral Movement · sigma-rule
• Remote Service Activity via SVCCTL Named Pipe · sigma-rule
• Remote Task Creation via ATSVC Named Pipe · sigma-rule
• Remote Task Creation via ATSVC Named Pipe - Zeek · sigma-rule
• Restricted Software Access By SRP · sigma-rule
• Rundll32 Execution Without Parameters · sigma-rule
• Rundll32 UNC Path Execution · sigma-rule
• SMB Create Remote File Admin Share · sigma-rule
• SMB Spoolss Name Piped Usage · sigma-rule
• smbexec.py Service Installation · sigma-rule
• Successful Overpass the Hash Attempt · sigma-rule
• Suspicious BitLocker Access Agent Update Utility Execution · sigma-rule
• Suspicious Csi.exe Usage · sigma-rule
• Suspicious New-PSDrive to Admin Share · sigma-rule
• Suspicious Non PowerShell WSMAN COM Provider · sigma-rule
• Suspicious Plink Port Forwarding · sigma-rule
• Suspicious PsExec Execution · sigma-rule
• Suspicious PsExec Execution - Zeek · sigma-rule
• Suspicious RDP Redirect Using TSCON · sigma-rule
• Suspicious Remote Logon with Explicit Credentials · sigma-rule
• Suspicious Speech Runtime Binary Child Process · sigma-rule
• Suspicious SysAidServer Child · sigma-rule
• Suspicious UltraVNC Execution · sigma-rule
• Suspicious WSMAN Provider Image Loads · sigma-rule
• T1047 Wmiprvse Wbemcomn DLL Hijack · sigma-rule
• Terminal Service Process Spawn · sigma-rule
• Uncommon Outbound Kerberos Connection · sigma-rule
• Uncommon Outbound Kerberos Connection - Security · sigma-rule
• Unsigned or Unencrypted SMB Connection to Share Established · sigma-rule
• User Added to Remote Desktop Users Group · sigma-rule
• User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' · sigma-rule
• Windows Admin Share Mount Via Net.EXE · sigma-rule
• Windows Internet Hosted WebDav Share Mount Via Net.EXE · sigma-rule
• Windows Share Mount Via Net.EXE · sigma-rule
• Winrs Local Command Execution · sigma-rule
• WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load · sigma-rule
• Wmiexec Default Output File · sigma-rule
• Wmiprvse Wbemcomn DLL Hijack · sigma-rule
• Wmiprvse Wbemcomn DLL Hijack - File · sigma-rule
• Writing Local Admin Share · sigma-rule
• Zerologon Exploitation Using Well-known Tools · sigma-rule