We need immediate guidance on detecting lateral movement in networks when attackers are using living off the land binaries like WMI and bitsadmin.
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
We need immediate guidance on detecting lateral movement in networks when attackers are using living off the land binaries like WMI and bitsadmin.
2 real searches · 1 real-search pass
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
Microsoft Windows security auditing WMI remote process creation event logs BITS operational log detection lateral movement Sysmon process creation network connections Google ↗
MITRE ATT&CK Windows Management Instrumentation WMI lateral movement BITS jobs detection analytics Google ↗
- Sysmon events · learn.microsoft.com
- Sysmon - Sysinternals · learn.microsoft.com
- Read and tune Sysmon events on Windows · learn.microsoft.com
- Windows Management Instrumentation, Technique T1047 - Enterprise · attack.mitre.org
- SolarWinds and Active Directory/M365 Compromise: · cisa.gov
- Analytics · attack.mitre.org
- Exploitation of Remote Services – multi-platform lateral movement detection, Detection Strategy DET0118 · attack.mitre.org
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
Microsoft Windows security auditing WMI remote process creation event logs BITS operational log detection lateral movement Sysmon process creation network connections OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
MITRE ATT&CK Windows Management Instrumentation WMI lateral movement BITS jobs detection analytics OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |