Lateral Movement

RDP, SMB admin shares, WinRM, SSH, and VNC used with valid credentials to reach new hosts.

Detect it with
Event ID 4624 Type 3 and Type 10 from unusual source workstations; new admin share access patterns.

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network.

Detect it with
Detection methods will vary depending on the type of third-party software or system and how it is typically used.

Planting malicious files or shortcuts on network shares so other users execute them.

Detect it with
New executables and .lnk files on shares, followed by execution from a UNC path on multiple hosts.

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.

Detect it with
Monitor file access on removable media. Detect processes that execute from removable media after it is mounted or when initiated by a user.

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Detect it with
Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash.

After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization.

Detect it with
Network intrusion detection systems and email gateways usually do not scan internal email, but an organization can leverage the journaling-based solution which sends a copy of emails to a security service for offline analysis or incorporate service-integrated solutions using…

Pass-the-hash, pass-the-ticket, and stolen web session cookies authenticating without the password.

Detect it with
NTLM logons where Kerberos is expected; a logon with no preceding interactive credential entry.

Taking over an existing RDP or SSH session that is already authenticated.

Detect it with
tscon.exe use; a session reconnecting from a different source address mid-session.

Copying tooling between internal hosts over SMB or a remote management channel.

Detect it with
Executables written to C$ or ADMIN$ followed within seconds by a service creation on the same host.