Rare lateral movement within 5m of ClosedQuorum LLM C2 round-trip

Arnold Chan@slaz

•updated Sep 23, 2026•0•0•3

Detects lateral movement (SMB, RDP, WinRM) performed by a host within 5 minutes of communicating with specific commercial LLM APIs. This rule targets behaviors indicative of automated lateral movement driven by an LLM-based C2, excluding common administrative tools, standard business hours, and frequently used processes.