Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Rhysida – PowerView Recon Followed by Impacket-Based Lateral Movement

Rhysida Lateral Movement Sentinel
MITRE ATT&CK
SMB/Windows Admin Shares
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (rhysida)
What This Detects
Ahead of its wevtutil/ntdsutil defense-evasion step, Rhysida runs PowerView for AD recon and then uses Impacket tooling (wmiexec/smbexec-style) to move laterally over SMB.
Query
let powerview = DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("PowerView","Get-NetDomain","Get-NetComputer")
| project DeviceName, ReconTime = Timestamp;
let impacket = DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("wmiexec.py","smbexec.py","atexec.py") or InitiatingProcessFileName =~ "wmiprvse.exe"
| project DeviceName, MoveTime = Timestamp;
powerview
| join kind=inner impacket on DeviceName
| where MoveTime - ReconTime between (0min .. 4h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.