Splunk Search: Lateral Movement

[johann2017]

Hello! I am wanting to build a search that can help detect lateral movement. I want to see when the same user is logging into multiple machines in a specific period of time. For example, an admin account gets compromised. That same admin account was then used to log into 50 different computers in the course of an hour. How would I run a search similar to something like that?

[sduff_splunk]

Something like the following would count the number of unique hostnames ( dc = distinct count) that the Admin has logged into.

index=wineventlog Logon user=Administrator earliest=-65m@m | stats dc(hostname), values(hostname)

You may also want to look at the Security Essentials app, https://splunkbase.splunk.com/app/3435/ , which hassome examples of such searches and use-cases.