08 · Lateral Movement
Lateral Movement Forensics: RDP, PsExec, WMI and WinRM
Map source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
Articles tagged: #lateral-movement
08 · Lateral Movement
Remote Access Tool Forensics: AnyDesk, TeamViewer and More
Investigate abused RMM and remote access tools on Windows: install traces, per-tool logs, session IDs and IPs, file transfers and telling attackers from IT.