Threat Hunting
Proactively search for threats in your environment
Hunt Sessions
Lateral Movement Detection
Unusual PowerShell Activity
C2 Beaconing
Credential Dumping
Data Staging
Hunt Hypothesis
Current Hypothesis:
Adversary is using WMI for lateral movement across domain-joined systems, potentially leveraging compromised admin credentials to execute remote commands.
Query Builder
Time Range:
Query Results
142 results in 1.23s
| Timestamp | Computer | User | Process | Command Line | Count |
|---|---|---|---|---|---|
| 2024-12-13 10:45:22 | WKS-CLIENT-042 | admin_svc | wmiprvse.exe | wmic process call create "powershell.exe -enc ..." |
12 |
| 2024-12-13 10:43:15 | WKS-CLIENT-038 | admin_svc | wmiprvse.exe | wmic /node:192.168.1.50 process call create ... |
8 |
| 2024-12-13 10:41:03 | WKS-CLIENT-015 | system | wmiprvse.exe | C:\Windows\System32\wbem\wmiprvse.exe |
6 |
| 2024-12-13 10:38:47 | WKS-CLIENT-042 | admin_svc | wmiprvse.exe | invoke-wmimethod -computername ... -class Win32_Process |
15 |
| 2024-12-13 10:35:12 | SRV-WEB-01 | admin_svc | wmiprvse.exe | wmic process call create "cmd.exe /c lateral_move.bat" |
9 |
Query Templates
Suspicious PowerShell
Encoded commands
Lateral Movement
WMI, PSExec, RDP
Credential Dumping
LSASS access
C2 Beaconing
Periodic connections
Privilege Escalation
Token manipulation
Data Exfiltration
Large outbound transfers
Persistence
Registry, services, tasks
Unusual File Access
Sensitive directories
Findings (3)
Compromised Admin Account
Critical
User: admin_svc
Lateral movement to 8 systems
Encoded PowerShell
High
Base64 encoded commands
42 instances detected
Unusual WMI Activity
High
Remote process creation
15+ executions in 1 hour
Hunt Notes & Analysis
IOCs Identified:
User Account: admin_svc (compromised)
IP Addresses: 192.168.1.42, 192.168.1.50, 192.168.1.105
File Hashes: d41d8cd98f00b204e9800998ecf8427e
Command: "powershell.exe -enc SGVsbG8gV29ybGQ="
IP Addresses: 192.168.1.42, 192.168.1.50, 192.168.1.105
File Hashes: d41d8cd98f00b204e9800998ecf8427e
Command: "powershell.exe -enc SGVsbG8gV29ybGQ="
Analysis Summary:
Identified lateral movement pattern using WMI for remote command execution. The compromised account "admin_svc" was used to execute encoded PowerShell commands on 8 different systems. Pattern suggests automated tooling, possibly Cobalt Strike or similar C2 framework.
Next Steps:
- Create incident case for compromised admin_svc account
- Isolate affected systems: WKS-CLIENT-042, WKS-CLIENT-038, SRV-WEB-01
- Reset credentials for admin_svc and related service accounts
- Deploy detection rule for WMI lateral movement pattern
- Conduct memory forensics on affected endpoints