loading…
Active_Directory_Security
/
tools
/ tool editor
active__hunt_lateral_movement
name (registry, task__-namespaced)
description
Search for indicators of lateral movement using pass-the-hash, pass-the-ticket, or credential dumping techniques
behavior spec (steers the decoy + judge)
read-only
JSON Schema (arguments)
✓ valid · 4 props · 1 required
{ "type": "object", "required": [ "technique" ], "properties": { "technique": { "enum": [ "pass_the_hash", "pass_the_ticket", "credential_dumping", "psexec", "wmi", "all" ], "type": "string" }, "time_range": { "enum": [ "1h", "4h", "24h", "7d" ], "type": "string" }, "source_host": { "type": "string" }, "target_hosts": { "type": "array", "items": { "type": "string" } } } }
Save tool
registry name changes propagate to the decoy surface on the next drain