Lateral Movement via Admin Tools Post-Compromise

Ankit Mehta@Secvyn

•updated Jun 16, 2026•1•0•4

This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.