Lateral movement via SMB from compromised workstation
🛡️ ProPera Intelligence background analysis - no action needed to view
⏳
Correlating behaviour, intelligence and relationships…Details
Incident IDINC-01003 (1003)
Created2026-08-16 20:07 UTC
Last updated2026-08-16 22:07 UTC
Assigned to-
Tagslateral-movement
SourceDemo
Alerts1
Devices & Users
Devicescorp-srv-app02
Userssvc-backup@propera.local
DeterminationUnknown
Alerts in this incident 1
| Alert | Severity | Status | Category | Device | User | MITRE |
|---|---|---|---|---|---|---|
| SMB admin share access from unusual source | High | New | LateralMovement | corp-srv-app02 | svc-backup@propera.local | T1021.002T1570 |
Evidence timeline
20:07:49 UTC · Network
SMB connection to admin share
20:07:49 UTC · Process
PsExec-style service execution
psexec.exe \\corp-srv-app02 -s cmd.exe
C:\Users\j.doe\AppData\Local\Temp\psexec.exe
Comments & updates
💬
No comments yet.Update incident
