Are there any specific indicators of compromise to look for when investigating potential lateral movement through SMBv3 tunnels in our branch offices?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
Are there any specific indicators of compromise to look for when investigating potential lateral movement through SMBv3 tunnels in our branch offices?
1 real search · 1 real-search pass
Microsoft Windows security auditing event 5140 5145 4624 SMB lateral movement detection Sysmon named pipes services MITRE ATT&CK SMB Windows Admin SharesGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 1 queries…
Searches and sources
ChatGPT1 real searches · gpt-6
Microsoft Windows security auditing event 5140 5145 4624 SMB lateral movement detection Sysmon named pipes services MITRE ATT&CK SMB Windows Admin Shares Google ↗
- Named Pipe Metadata, Data Component DC0048 · attack.mitre.org
- Sysmon events · learn.microsoft.com
- SMB/Windows Admin Shares · redcanary.com
- Multi-Event Detection for SMB Admin Share Lateral Movement, Detection Strategy DET0530 · attack.mitre.org
- Remote Services: SMB/Windows Admin Shares, Sub-technique T1021.002 - Enterprise · attack.mitre.org