T1021

Remote Services

Lateral Movement Last updated:

Adversaries may use Valid Accounts to log into services that accept remote connections, such as SSH, RDP, SMB, WinRM, VNC, and DCOM, to perform lateral movement. In enterprise environments where domains provide centralized identity management, compromised credentials allow adversaries to authenticate to many machines using remote access protocols. Adversaries may also abuse legitimate remote management tools such as Apple Remote Desktop (ARD) on macOS. Detection focuses on identifying anomalous authentication patterns, unusual source/destination pairs, off-hours access, atypical account usage, and service abuse sequences consistent with credential-driven lateral movement.

What is T1021 Remote Services?

Remote Services (T1021) maps to the Lateral Movement tactic — the adversary is trying to move through your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Remote Services, covering the data sources and telemetry it touches: Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation, Windows Security Event Log, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Lateral Movement
Technique
T1021 Remote Services
Canonical reference
https://attack.mitre.org/techniques/T1021/
Microsoft Sentinel / Defender
kusto 
// T1021 Remote Services — Lateral Movement via Remote Authentication
// Covers: RDP (logon type 10), Network logons (type 3), and anomalous remote auth patterns
let LookbackWindow = 24h;
let PrivilegedAccounts = dynamic(["administrator", "admin", "svc-", "service", "backup"]);
let SuspiciousHours = range(0, 5);  // midnight to 5am
// Branch 1: Remote Interactive / RDP logons (Logon Type 10) from unusual sources
let RemoteInteractiveLogons = SecurityEvent
| where TimeGenerated > ago(LookbackWindow)
| where EventID == 4624
| where LogonType == 10  // RemoteInteractive (RDP)
| extend SourceHost = IpAddress
| where isnotempty(SourceHost) and SourceHost !in ("127.0.0.1", "::1", "-")
| extend IsAfterHours = hourofday(TimeGenerated) in (SuspiciousHours)
| extend IsPrivilegedAccount = TargetUserName has_any (PrivilegedAccounts)
| project TimeGenerated, Computer, TargetUserName, TargetDomainName, SourceHost,
         LogonType, LogonTypeName="RemoteInteractive", IsAfterHours, IsPrivilegedAccount,
         ProcessName, AuthenticationPackageName;
// Branch 2: Network logons (Logon Type 3) — SMB, WinRM, lateral movement
let NetworkLogons = SecurityEvent
| where TimeGenerated > ago(LookbackWindow)
| where EventID == 4624
| where LogonType == 3  // Network
| extend SourceHost = IpAddress
| where isnotempty(SourceHost) and SourceHost !in ("127.0.0.1", "::1", "-")
| where TargetUserName !endswith "$"  // exclude machine accounts
| where TargetUserName !in~ ("ANONYMOUS LOGON", "LOCAL SERVICE", "NETWORK SERVICE")
| extend IsAfterHours = hourofday(TimeGenerated) in (SuspiciousHours)
| extend IsPrivilegedAccount = TargetUserName has_any (PrivilegedAccounts)
| project TimeGenerated, Computer, TargetUserName, TargetDomainName, SourceHost,
         LogonType, LogonTypeName="Network", IsAfterHours, IsPrivilegedAccount,
         ProcessName, AuthenticationPackageName;
// Branch 3: MDE DeviceLogonEvents — enriched remote logon telemetry
let MdeRemoteLogons = DeviceLogonEvents
| where Timestamp > ago(LookbackWindow)
| where LogonType in ("RemoteInteractive", "Network", "NetworkCleartext")
| where isnotempty(RemoteIP) and RemoteIP !in ("127.0.0.1", "::1")
| where ActionType == "LogonSuccess"
| extend IsAfterHours = hourofday(Timestamp) in (SuspiciousHours)
| extend IsPrivilegedAccount = AccountName has_any (PrivilegedAccounts)
| project TimeGenerated=Timestamp, Computer=DeviceName, TargetUserName=AccountName,
         TargetDomainName=AccountDomain, SourceHost=RemoteIP, LogonType,
         LogonTypeName=LogonType, IsAfterHours, IsPrivilegedAccount,
         ProcessName=InitiatingProcessFileName, AuthenticationPackageName="MDE";
// Combine and flag high-interest events
union RemoteInteractiveLogons, NetworkLogons, MdeRemoteLogons
| extend RiskScore = case(
    IsAfterHours and IsPrivilegedAccount, 3,
    IsAfterHours or IsPrivilegedAccount, 2,
    true, 1)
| where RiskScore >= 1
| summarize LogonCount=count(),
            TargetHosts=make_set(Computer),
            TargetHostCount=dcount(Computer),
            FirstSeen=min(TimeGenerated),
            LastSeen=max(TimeGenerated),
            LogonTypes=make_set(LogonTypeName),
            MaxRiskScore=max(RiskScore)
  by TargetUserName, TargetDomainName, SourceHost
| where TargetHostCount > 1 or MaxRiskScore >= 2  // Lateral spread or high-risk single hop
| sort by MaxRiskScore desc, TargetHostCount desc

Detects anomalous remote authentication activity consistent with lateral movement via Remote Services (T1021). Combines Security Event ID 4624 (logon type 3/network and type 10/remote interactive) with MDE DeviceLogonEvents for enriched coverage. Scores events by risk factors including after-hours access and privileged account use, then aggregates by source account and host to surface multi-host lateral movement patterns. A single high-risk logon (privileged account, after hours) surfaces alongside multi-host spread.

high severity medium confidence

Data Sources

Logon Session: Logon Session Creation Network Traffic: Network Connection Creation Windows Security Event Log Microsoft Defender for Endpoint

Required Tables

SecurityEvent DeviceLogonEvents

False Positives

  • IT administrators performing routine remote management across multiple servers using RDP or WinRM during business hours
  • Service accounts with legitimate need to authenticate to multiple systems (backup agents, monitoring solutions, SCCM/Intune management)
  • Help desk staff using Remote Desktop to provide support to end users — generates high-volume type 10 logons from a single source
  • Jump server / bastion host authentication patterns where a single source IP authenticates to many destination hosts as a normal workflow
  • Vulnerability scanners and infrastructure automation tools (Ansible, Puppet, Chef) that authenticate network-wide via type 3 logons

Sigma rule & cross-platform mapping

The detection logic for Remote Services (T1021) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: network_connection
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1021 Sigma rules on detection.fyi

Platform-specific guides for T1021

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (10)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1RDP Lateral Movement to localhost (logon type 10)

    Expected signal: Security Event ID 4624 on localhost with LogonType=10, TargetUserName=current user, IpAddress=127.0.0.1. Security Event ID 4648 (Explicit Credential Logon) for the cmdkey credential staging. Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational: EventID 1149 (User authentication succeeded) with client IP 127.0.0.1.

  2. Test 2SMB Network Logon to admin share (logon type 3)

    Expected signal: On TARGET_HOST — Security Event ID 4624 with LogonType=3, source IP = testing machine IP, TargetUserName=testuser. Security Event ID 4776 (NTLM credential validation) if NTLM is used. Optionally Security Event ID 5140 (network share accessed) and 5145 (share object access) if share auditing is enabled. Sysmon Event ID 3 on source machine showing outbound TCP to TARGET_HOST:445.

  3. Test 3WinRM remote command execution (lateral movement via PowerShell Remoting)

    Expected signal: On TARGET_HOST — Security Event ID 4624 LogonType=3 with source IP of testing machine. Microsoft-Windows-WinRM/Operational EventID 91 (Creating WSMan session) and EventID 169 (User authenticated successfully). PowerShell ScriptBlock Log Event ID 4104 on TARGET_HOST with the executed commands. Sysmon Event ID 3 on source machine: outbound TCP to TARGET_HOST:5985 (HTTP) or 5986 (HTTPS).

  4. Test 4SSH lateral movement (Linux — key-based authentication to remote host)

    Expected signal: On REMOTE_HOST — /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS): 'Accepted publickey for testuser from SOURCE_IP port PORT ssh2'. auditd (if enabled): SYSCALL records for sshd process with uid mapping. Syslog entries: sshd[PID]: session opened for user testuser by (uid=0). On source host: ~/.ssh/known_hosts updated if new host.

Response Playbook

Triage

  1. Identify the source account and source IP: is this a known IT admin, service account, or an interactive user account? Check whether the source IP belongs to a known jump server, bastion host, or admin workstation — if so, evaluate the destination hosts accessed.
  2. Count the number of unique target hosts accessed by this account within the time window. Lateral movement typically involves 2+ hosts in quick succession; a single one-off RDP from an admin workstation is low-fidelity on its own.
  3. Check the logon type breakdown: Type 10 (RemoteInteractive/RDP) from an unusual workstation is higher fidelity than Type 3 (Network) which includes legitimate SMB. Type 3 from a non-server workstation toward servers is more suspicious.
  4. Review authentication timing: is access occurring outside business hours (nights/weekends)? Adversaries frequently move laterally during low-monitoring windows. Compare against the user's typical logon schedule in Active Directory or Azure AD sign-in logs.
  5. Correlate with recent credential events: check for preceding 4648 (explicit credential logon), 4768/4769 (Kerberos TGT/service ticket requests), or 4776 (NTLM validation) events from the same source that would indicate pass-the-hash, pass-the-ticket, or stolen credential use.
  6. Check for prior failed logon attempts (4625) from the same source to the same or other destinations — a burst of failures followed by success is a strong indicator of credential brute force or spraying.
  7. Review what processes were launched on the destination host after the remote logon: look for reconnaissance tools (whoami, net user, ipconfig), credential dumping (lsass access), or persistence mechanisms deployed within the session.

Containment

  1. If active lateral movement is confirmed: immediately isolate the compromised source host and any destination hosts where the adversary successfully established sessions using EDR endpoint isolation or emergency VLAN change.
  2. Disable the compromised user account in Active Directory (Set-ADUser -Enabled $false) and revoke all active Kerberos tickets (klist purge on endpoints, or use Invoke-ADReplication to force a krbtgt password reset if Golden Ticket is suspected).
  3. If pass-the-hash is suspected: reset the NTLM hash by performing a password reset on the compromised account. For domain admins, rotate the krbtgt account password twice to invalidate all issued Kerberos tickets.
  4. Block the source IP at the network level (firewall, NAC) if it is not a sanctioned admin workstation. If it is a legitimate workstation that is compromised, isolate it immediately.
  5. Revoke active RDP and WinRM sessions on destination hosts: use 'query session /server:<host>' to identify and terminate rogue sessions with 'logoff <session_id> /server:<host>'.
  6. If SSH lateral movement on Linux is confirmed: check and rotate all SSH authorized_keys files on destination systems, revoke compromised user's shell access, and review /etc/passwd for any new accounts added.

Evidence Collection

  1. Windows Security Event Log on both source and destination hosts: collect Event IDs 4624, 4625, 4634 (logoff), 4648 (explicit credentials), 4672 (special privileges assigned), 4768, 4769 (Kerberos), and 4776 (NTLM) for the relevant time window.
  2. Remote Desktop Services log on destination hosts: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational and Microsoft-Windows-TerminalServices-LocalSessionManager/Operational — records RDP session establishment and teardown with source IP.
  3. WinRM and PowerShell Remoting logs: Microsoft-Windows-WinRM/Operational and Microsoft-Windows-PowerShell/Operational on destination hosts for remote command execution evidence.
  4. SMB access logs via file share audit events (4656, 4663) on destination hosts if admin shares (C$, ADMIN$, IPC$) were accessed.
  5. Process creation events (Sysmon Event ID 1 or Security Event ID 4688 with command line auditing) on destination hosts for the timeframe immediately following the remote logon — identifies what the adversary executed.
  6. Network flows / firewall logs: capture source-to-destination IP:port connections on ports 3389 (RDP), 445 (SMB), 5985/5986 (WinRM), 22 (SSH), 5900 (VNC) around the time of the incident.
  7. LSASS memory artifacts on source host: check for evidence of credential dumping (Sysmon Event ID 10 — Process Access to lsass.exe) that may have preceded the lateral movement.
  8. Active Directory audit logs: review changes to group membership, delegation settings, or account attributes that may have facilitated the access.

Escalation Criteria

  • ! Source account is a domain admin, enterprise admin, or service account with broad permissions — any unauthorized remote access by these accounts is critical and requires immediate response.
  • ! Multi-hop lateral movement confirmed: the destination host itself then initiates outbound remote connections, indicating the adversary is using each compromised host as a pivot point to reach deeper network segments.
  • ! Evidence of credential dumping (lsass.exe accessed via Sysmon Event ID 10, or comsvcs.dll MiniDump) on any host involved in the remote logon chain — adversary is actively harvesting new credentials to fuel further lateral movement.
  • ! Pass-the-Hash or Pass-the-Ticket indicators: NTLM authentication (Event ID 4776) from a host where the user never interactively logged on, or Kerberos ticket requests (4768/4769) for service accounts from unusual sources.
  • ! Remote sessions establishing persistence mechanisms: scheduled tasks (Event ID 4698), service installations (Event ID 7045/4697), or registry run key modifications on destination hosts.
  • ! Destination hosts include domain controllers, certificate authorities, backup servers, or other Tier 0 assets — any unauthorized remote access to these systems is a critical severity incident.

Investigation Guide

Forensic Artifacts

  • > Windows Event Log: Security.evtx on destination hosts — Event IDs 4624 (logon), 4625 (failed logon), 4634 (logoff), 4648 (explicit credential use), 4672 (privileged logon) with source IP and logon type
  • > Windows Event Log: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational.evtx — RDP connection records with client IP, username, and session ID
  • > Windows Event Log: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational.evtx — RDP session start/disconnect/logoff events with timestamps
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp — RDP port and listener configuration
  • > Registry: HKCU\SOFTWARE\Microsoft\Terminal Server Client\Servers — recently connected RDP servers from the client side (source host forensics)
  • > File System: C:\Windows\System32\winevt\Logs\ — raw event log files for offline forensic analysis
  • > File System: %APPDATA%\Microsoft\Windows\Recent\ on destination host — recently accessed files during the remote session
  • > Network: Firewall or switch flow logs showing TCP connections on ports 3389, 445, 5985, 5986, 22, 5900 between relevant hosts
  • > Memory: LSASS process dump (if legal and authorized) to identify credential material or injection artifacts
  • > Linux: /var/log/auth.log or /var/log/secure — SSH authentication events including accepted/failed keys and remote IP; also ~/.ssh/known_hosts on source for pivot trail

Tuning Guidance

Remote Services detection generates significant noise in well-managed enterprise environments. Begin by profiling legitimate remote administration patterns: identify your jump servers, RDP gateway IPs, and admin workstations, then exclude these from the multi-host spread alerts (not from alerting entirely — just raise the threshold). For service accounts, build an explicit allowlist of the accounts authorized for automated remote logons (backup agents, monitoring, SCCM) and their expected source IPs. Exclude these specific account+IP combinations, not the accounts globally. Pay particular attention to LogonType 3 (Network) versus LogonType 10 (RemoteInteractive) — most legitimate admin tools use Type 3 while adversaries prefer Type 10 (RDP) for interactive sessions. The most reliable signal in low-noise environments is the first-seen relationship hunt: tune your 30-day baseline window and investigate every new (user, source IP, destination host) triple. For critical assets like domain controllers and Tier 0 systems, apply zero-tolerance policies with no baselines — any remote logon from a non-approved source should alert immediately regardless of time or account type. Consider integrating with your CMDB to automatically tag logons from known administrative tooling source IPs (Ansible, SCCM, backup platforms) to create a 'sanctioned' flag that suppresses lower-risk alerts while still capturing anomalies.

Hunting Queries

Hunt for user accounts that have authenticated to 4 or more distinct hosts via remote logon within the past 7 days. Legitimate users rarely need remote access to many hosts; a high unique-target count strongly suggests credential compromise and lateral movement. The spread duration helps distinguish automated worm-like propagation (seconds/minutes) from slow adversary-driven movement (hours/days).

Hunting — KQL
kql 
// Hunt: Accounts authenticating to an unusual number of distinct hosts (potential lateral spread)
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624
| where LogonType in (3, 10)
| where TargetUserName !endswith "$"
| where TargetUserName !in~ ("ANONYMOUS LOGON", "LOCAL SERVICE", "NETWORK SERVICE", "SYSTEM")
| where IpAddress !in ("127.0.0.1", "-", "::1")
| summarize UniqueTargets=dcount(Computer),
            TargetList=make_set(Computer, 20),
            UniqueSourceIPs=dcount(IpAddress),
            TotalLogons=count(),
            EarliestLogon=min(TimeGenerated),
            LatestLogon=max(TimeGenerated)
  by TargetUserName, TargetDomainName
| where UniqueTargets >= 4
| extend SpreadDurationMinutes = datetime_diff('minute', LatestLogon, EarliestLogon)
| sort by UniqueTargets desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 (LogonType=3 OR LogonType=10) NOT (TargetUserName="*$" OR TargetUserName="ANONYMOUS LOGON" OR TargetUserName="LOCAL SERVICE" OR TargetUserName="NETWORK SERVICE") NOT (IpAddress="127.0.0.1" OR IpAddress="::1" OR IpAddress="-")
| stats dc(ComputerName) as UniqueTargets, values(ComputerName) as TargetList, dc(IpAddress) as UniqueSourceIPs, count as TotalLogons, earliest(_time) as EarliestLogon, latest(_time) as LatestLogon by TargetUserName
| where UniqueTargets >= 4
| eval SpreadDurationMinutes=round((LatestLogon - EarliestLogon) / 60, 0)
| sort - UniqueTargets

Hunt for first-seen remote logon relationships — a specific (account, source IP, destination host) triple that has no historical precedent in the prior 30-day baseline. New source IPs authenticating to hosts via existing accounts may indicate credential compromise with access from a new attacker-controlled machine. Particularly valuable for detecting RDP/SMB access from newly provisioned attacker infrastructure.

Hunting — KQL
kql 
// Hunt: New remote logon relationships — source IPs never seen before on a destination host
let HistoricalBaseline = SecurityEvent
| where TimeGenerated between (ago(30d) .. ago(7d))
| where EventID == 4624 and LogonType in (3, 10)
| where IpAddress !in ("127.0.0.1", "-", "::1")
| summarize by Computer, TargetUserName, IpAddress;
let RecentLogons = SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624 and LogonType in (3, 10)
| where IpAddress !in ("127.0.0.1", "-", "::1")
| where TargetUserName !endswith "$";
RecentLogons
| join kind=leftanti HistoricalBaseline
  on Computer, TargetUserName, IpAddress
| project TimeGenerated, Computer, TargetUserName, TargetDomainName, IpAddress,
         LogonType, ProcessName, AuthenticationPackageName
| sort by TimeGenerated desc
Hunting — SPL
spl 
| inputlookup remote_logon_baseline.csv
| rename host as ComputerName, user as TargetUserName, src_ip as IpAddress
| eval baseline=1
| append
  [ search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 (LogonType=3 OR LogonType=10) NOT (IpAddress="127.0.0.1" OR IpAddress="::1" OR IpAddress="-") NOT (TargetUserName="*$")
    | eval baseline=0
    | table _time, ComputerName, TargetUserName, IpAddress, LogonType, baseline ]
| stats values(baseline) as seen_in by ComputerName, TargetUserName, IpAddress
| where NOT (seen_in="0 1" OR seen_in="1" OR seen_in="1 0")
| where seen_in="0"
| join type=inner ComputerName, TargetUserName, IpAddress
  [ search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 (LogonType=3 OR LogonType=10) | table _time, ComputerName, TargetUserName, IpAddress, LogonType ]
| table _time, ComputerName, TargetUserName, IpAddress, LogonType
| sort - _time

Hunt for the same account authenticating to different hosts within 5-minute windows — a pattern consistent with rapid automated lateral movement, worm propagation (Wizard Spider/Ryuk), or adversary-controlled tooling executing sequential pivots. The hop chain output visualizes the movement path, helping analysts reconstruct the lateral movement sequence.

Hunting — KQL
kql 
// Hunt: Rapid sequential remote logons across hosts (worm-speed lateral movement)
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624
| where LogonType in (3, 10)
| where TargetUserName !endswith "$"
| where IpAddress !in ("127.0.0.1", "-", "::1")
| sort by TargetUserName asc, TimeGenerated asc
| serialize
| extend TimeSincePriorLogon = datetime_diff('second', TimeGenerated, prev(TimeGenerated))
| extend SameUser = TargetUserName == prev(TargetUserName)
| extend DifferentHost = Computer != prev(Computer)
| where SameUser and DifferentHost and TimeSincePriorLogon between (1 .. 300)  // Different host within 5 minutes
| summarize RapidHops=count(),
            HopChain=make_list(strcat(prev(Computer), "→", Computer)),
            MinIntervalSeconds=min(TimeSincePriorLogon),
            FirstHop=min(TimeGenerated)
  by TargetUserName, TargetDomainName
| where RapidHops >= 2
| sort by RapidHops desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 (LogonType=3 OR LogonType=10) NOT (TargetUserName="*$" OR IpAddress="127.0.0.1" OR IpAddress="::1" OR IpAddress="-")
| sort TargetUserName, _time
| streamstats current=true window=2 values(ComputerName) as HostPair, range(_time) as IntervalSeconds by TargetUserName
| eval IntervalSeconds=round(IntervalSeconds,0)
| where IntervalSeconds <= 300
| eval HostCount=mvcount(HostPair)
| where HostCount >= 2
| eval HostPairStr=mvjoin(HostPair, " -> ")
| where HostPair != mvindex(HostPair, 0)  | stats count as RapidHops, min(IntervalSeconds) as MinIntervalSec, earliest(_time) as FirstHop, values(HostPairStr) as HopChains by TargetUserName
| where RapidHops >= 2
| sort - RapidHops

Atomic Red Team Tests

Test 1 RDP Lateral Movement to localhost (logon type 10)
windows

Simulates Remote Desktop Protocol authentication by connecting to localhost over RDP. This generates a Security Event ID 4624 with LogonType=10 (RemoteInteractive) on the local machine, which is the exact telemetry produced when an adversary pivots to a remote host via RDP using stolen credentials. Uses the built-in cmdkey to stage credentials and mstsc to initiate the connection.

Command

powershell 
cmdkey /generic:localhost /user:$env:USERNAME /pass:TestPassword123!
mstsc /v:localhost /w:800 /h:600

Cleanup

powershell 
cmdkey /delete:localhost

Expected Telemetry

Security Event ID 4624 on localhost with LogonType=10, TargetUserName=current user, IpAddress=127.0.0.1. Security Event ID 4648 (Explicit Credential Logon) for the cmdkey credential staging. Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational: EventID 1149 (User authentication succeeded) with client IP 127.0.0.1.

Expected Detection

KQL: Logon type 10 event from localhost fires in RemoteInteractiveLogons branch. SPL: EventCode=4624 LogonType=10 captured. Note: 127.0.0.1 is excluded in production queries; use a second test machine or temporarily comment out the IP exclusion to validate the full pipeline.

Test 2 SMB Network Logon to admin share (logon type 3)
windows

Accesses the administrative share (C$) of a target host via SMB using net use. This generates a Security Event ID 4624 with LogonType=3 (Network) on the target host — the same telemetry produced when adversaries use SMB lateral movement, Impacket's psexec/smbexec, or CobaltStrike's jump smb. Replace TARGET_HOST with an accessible test machine on your network.

Command

powershell 
net use \\TARGET_HOST\C$ /user:DOMAIN\testuser TestPassword123!
dir \\TARGET_HOST\C$\Windows\System32\cmd.exe
net use \\TARGET_HOST\C$ /delete

Cleanup

powershell 
net use \\TARGET_HOST\C$ /delete 2>NUL

Expected Telemetry

On TARGET_HOST — Security Event ID 4624 with LogonType=3, source IP = testing machine IP, TargetUserName=testuser. Security Event ID 4776 (NTLM credential validation) if NTLM is used. Optionally Security Event ID 5140 (network share accessed) and 5145 (share object access) if share auditing is enabled. Sysmon Event ID 3 on source machine showing outbound TCP to TARGET_HOST:445.

Expected Detection

KQL: NetworkLogons branch captures the Type 3 event. Aggregation detects if combined with other hosts. SPL: EventCode=4624 LogonType=3 captured, LogonTypeName=Network.

Test 3 WinRM remote command execution (lateral movement via PowerShell Remoting)
windows

Uses PowerShell Remoting over WinRM to execute a remote command on a target host. This is the telemetry footprint of T1021.006 (Windows Remote Management) and commonly used by adversaries with Invoke-Command or Enter-PSSession for lateral movement. Generates both a network logon on the target and WinRM operational log entries. Replace TARGET_HOST with a reachable test machine.

Command

powershell 
$cred = Get-Credential
Invoke-Command -ComputerName TARGET_HOST -Credential $cred -ScriptBlock { hostname; whoami; Get-Process | Select-Object -First 5 }

Expected Telemetry

On TARGET_HOST — Security Event ID 4624 LogonType=3 with source IP of testing machine. Microsoft-Windows-WinRM/Operational EventID 91 (Creating WSMan session) and EventID 169 (User authenticated successfully). PowerShell ScriptBlock Log Event ID 4104 on TARGET_HOST with the executed commands. Sysmon Event ID 3 on source machine: outbound TCP to TARGET_HOST:5985 (HTTP) or 5986 (HTTPS).

Expected Detection

KQL: DeviceLogonEvents with LogonType=Network and RemoteIP of testing machine, or SecurityEvent 4624 type 3. SPL: EventCode=4624 LogonType=3 from source IP. Multi-host aggregation fires if combined with other remote logons from same account.

Test 4 SSH lateral movement (Linux — key-based authentication to remote host)
linux

Simulates SSH-based lateral movement on Linux by authenticating to a remote host using an SSH key, which is the primary method used by adversaries on Unix/Linux infrastructure. Pass-the-key attacks using stolen authorized_keys entries or id_rsa files generate the same telemetry. Replace REMOTE_HOST with a test Linux system.

Command

bash 
ssh -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no testuser@REMOTE_HOST 'id; hostname; cat /etc/passwd | head -5'

Expected Telemetry

On REMOTE_HOST — /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS): 'Accepted publickey for testuser from SOURCE_IP port PORT ssh2'. auditd (if enabled): SYSCALL records for sshd process with uid mapping. Syslog entries: sshd[PID]: session opened for user testuser by (uid=0). On source host: ~/.ssh/known_hosts updated if new host.

Expected Detection

Linux Syslog query: index=linux sourcetype=linux_secure OR syslog 'Accepted publickey' with source IP of testing machine. Detection fires if account authenticates to multiple hosts. Hunting query identifies first-seen SSH relationships.

Related Detections

Tactic Hub

TA0008Lateral Movement

Sub-techniques (8)

Related Techniques

T1078Valid AccountsT1550.002Pass the HashT1550.003Pass the TicketT1021.001Remote Desktop ProtocolT1021.002SMB/Windows Admin SharesT1021.004SSHT1021.006Windows Remote ManagementT1110Brute ForceT1558Steal or Forge Kerberos TicketsT1563Remote Service Session Hijacking

Same Tactic: Lateral Movement

Popular Detections