Detecting Lateral Movement in Network
When to Use
- Monitoring enterprise networks for post-compromise lateral movement patterns (pass-the-hash, RDP hopping, PSExec)
- Building SIEM detection rules and alerts for common MITRE ATT&CK lateral movement techniques (T1021, T1570)
- Investigating suspected breaches by analyzing authentication patterns and network connections between internal hosts
- Hunting for anomalous east-west traffic patterns that indicate an attacker pivoting through the network
- Validating that network segmentation and access controls effectively limit lateral movement paths
Do not use as a substitute for endpoint detection and response (EDR) tools, for monitoring only north-south traffic while ignoring internal traffic flows, or without baseline knowledge of normal internal communication patterns.
Prerequisites
- Network security monitoring deployed at internal choke points (Zeek, Suricata, or network TAPs)
- SIEM platform (Splunk, Elastic, Microsoft Sentinel) collecting Windows Security Event Logs, DNS, and flow data
- Windows Event Log forwarding configured for Security events (4624, 4625, 4648, 4672, 4768, 4769)
- Baseline of normal internal authentication and connection patterns
- Understanding of MITRE ATT&CK Lateral Movement tactics (TA0008)
Workflow
Step 1: Configure Log Collection for Lateral Movement Detection
cat > /etc/filebeat/modules.d/security.yml << 'EOF'
- module: system
auth:
enabled: true
var.paths: ["/var/log/auth.log"]
syslog:
enabled: true
- module: zeek
connection:
enabled: true
var.paths: ["/opt/zeek/logs/current/conn.log"]
dns:
enabled: true
var.paths: ["/opt/zeek/logs/current/dns.log"]
smb_mapping:
enabled: true
var.paths: ["/opt/zeek/logs/current/smb_mapping.log"]
dce_rpc:
enabled: true
var.paths: ["/opt/zeek/logs/current/dce_rpc.log"]
EOF
cat >> /opt/zeek/share/zeek/site/local.zeek << 'EOF'
@load policy/protocols/smb
@load policy/protocols/conn/known-hosts
@load policy/protocols/conn/known-services
@load frameworks/intel/seen
EOF
sudo zeekctl deploy
Step 2: Build Detection Rules for Common Lateral Movement Techniques
pip3 install sigma-cli
cat > lateral_movement_pth.yml << 'EOF'
title: Pass-the-Hash Lateral Movement Detection
id: f8d98d6c-7a07-4d74-b064-dd4a3c244528
status: experimental
description: Detects network logon with NTLM authentication to multiple hosts
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 3
AuthenticationPackageName: NTLM
filter:
TargetUserName|endswith: '$'
condition: selection and not filter
timeframe: 15m
count:
field: ComputerName
min: 3
group-by: TargetUserName
level: high
tags:
- attack.lateral_movement
- attack.t1550.002
EOF
sigma convert -t splunk lateral_movement_pth.yml
sigma convert -t elasticsearch lateral_movement_pth.yml
Step 3: Network-Level Detection with Zeek
cat /opt/zeek/logs/current/smb_mapping.log | \
zeek-cut ts id.orig_h id.resp_h path | \
grep -iE "(admin\$|c\$|ipc\$)" | \
sort -t$'\t' -k2 | uniq -c | sort -rn
cat /opt/zeek/logs/current/conn.log | \
zeek-cut ts id.orig_h id.resp_h id.resp_p | \
awk '$4 == 445' | \
awk '{print $2}' | sort | uniq -c | sort -rn | head -10
cat /opt/zeek/logs/current/dce_rpc.log | \
zeek-cut ts id.orig_h id.resp_h operation | \
grep -i "wbem\|wmi" | sort | uniq -c | sort -rn
cat /opt/zeek/logs/current/conn.log | \
zeek-cut ts id.orig_h id.resp_h id.resp_p duration | \
awk '$4 == 3389 && $5 > 60' | \
sort -t$'\t' -k2 | head -20
cat /opt/zeek/logs/current/kerberos.log | \
zeek-cut ts id.orig_h id.resp_h client service success error_msg | \
grep -v "true" | head -20
sudo tee /opt/zeek/share/zeek/site/custom-detections/lateral-movement.zeek << 'ZEEKEOF'
@load base/frameworks/notice
@load base/frameworks/sumstats
module LateralMovement;
export {
redef enum Notice::Type += {
SMB_Lateral_Spread,
RDP_Lateral_Chain
};
const smb_host_threshold: count = 5 &redef;
const smb_time_window: interval = 15min &redef;
}
event ()
{
r1 = SumStats::Reducer(
=,
=(SumStats::UNIQUE)
);
SumStats::create([
=,
=smb_time_window,
=(r1),
(key: SumStats::Key, result: SumStats::Result) = {
result[] + 0.0;
},
=smb_host_threshold + 0.0,
(key: SumStats::Key, result: SumStats::Result) = {
NOTICE([
=SMB_Lateral_Spread,
=(,
key, result[], smb_time_window),
=key
]);
}
]);
}
event connection_state_remove(c: connection)
{
( c$ == 445/tcp && c$ Site::local_nets )
{
SumStats::observe(,
[=(c$)],
[=(c$)]
);
}
}
ZEEKEOF
zeekctl deploy
Step 4: Threat Hunting for Lateral Movement Indicators
cat /opt/zeek/logs/current/conn.log | \
zeek-cut ts id.orig_h id.resp_h | \
awk '{
key = $2
targets[key][$3] = 1
}
END {
for (src in targets) {
count = 0
for (dst in targets[src]) count++
if (count > 20) print src, count
}
}' | sort -k2 -rn
cat /opt/zeek/logs/current/conn.log | \
zeek-cut ts id.orig_h id.resp_h id.resp_p orig_bytes | \
awk '$4 == 445 && $5 > 10000000' | sort -t$'\t' -k5 -rn
Step 5: Automated Response and Containment
sudo iptables -I FORWARD -s 10.10.5.23 -j DROP
Step 6: Build Detection Dashboard
Key Concepts
| Term | Definition |
|---|
| Lateral Movement | MITRE ATT&CK tactic (TA0008) describing techniques attackers use to move through a network from one compromised system to another |
| Pass-the-Hash (T1550.002) | Using captured NTLM password hashes to authenticate to remote systems without knowing the plaintext password |
| PsExec (T1569.002) | Remote service execution tool that creates a temporary service on the target system, detectable by Event ID 7045 |
| East-West Traffic | Network communication between internal systems (as opposed to north-south traffic between internal and external networks) |
| Authentication Anomaly | Deviation from baseline authentication patterns such as a user logging into systems they never accessed before |
| Kerberoasting (T1558.003) | Requesting Kerberos service tickets for service accounts and cracking them offline, detectable via Event ID 4769 anomalies |
Tools & Systems
- Zeek: Network security monitor generating SMB, Kerberos, DCE-RPC, and connection logs for lateral movement analysis
- Splunk/Elastic SIEM: Log aggregation platforms for correlating authentication events, network flows, and service creation across the enterprise
- Sigma: Vendor-agnostic detection rule format for writing portable lateral movement detection rules across SIEM platforms
- Velociraptor: Endpoint forensics tool for collecting evidence from hosts involved in lateral movement chains
- BloodHound: Active Directory attack path analysis tool for identifying potential lateral movement routes before attackers exploit them
Common Scenarios
Scenario: Detecting a Ransomware Operator's Lateral Movement
Context: The SOC receives an alert for PsExec service creation on a file server (10.10.20.15) at 2:00 AM. The alert triggers a lateral movement investigation. The organization has Zeek network monitoring and Windows Event Log forwarding to Splunk.
Approach:
- Query Splunk for Event ID 7045 (service creation) on 10.10.20.15 to confirm PsExec execution and identify the source IP (10.10.5.23)
- Trace authentication history for 10.10.5.23: find Event ID 4624 Type 3 logons, discovering the host authenticated to 8 servers in the past hour using NTLM (pass-the-hash pattern)
- Check Zeek conn.log for 10.10.5.23: identify SMB connections (port 445) to 12 internal hosts and large file transfers to an external IP
- Build the attack timeline: initial compromise via phishing at 1:15 AM, credential dumping at 1:25 AM, lateral movement to 8 servers between 1:30-2:00 AM
- Identify all compromised hosts by tracing authentication chains: 10.10.5.23 -> 10.10.20.15 -> 10.10.20.16 -> 10.10.20.17
- Contain by quarantining all identified hosts to VLAN 999, disabling the compromised account, and blocking the external C2 IP
- Report the complete attack chain with timeline, affected hosts, and detection gaps
Pitfalls:
- Only investigating the single alert instead of tracing the full lateral movement chain across all hosts
- Not checking for persistence mechanisms on each compromised host before declaring containment
- Relying solely on Windows Event Logs without correlating network flow data, missing lateral movement via tools that do not generate Windows events
- Not establishing a baseline of normal internal authentication patterns, making anomaly detection impossible
Output Format
## Lateral Movement Investigation Report
**Case ID**: IR-2024-0312
**Initial Alert**: PsExec on 10.10.20.15 at 02:00 UTC
**Investigation Period**: 2024-03-15 01:00 to 03:00 UTC
### Attack Timeline
| Time (UTC) | Source | Destination | Technique | Evidence |
|------------|--------|-------------|-----------|----------|
| 01:15 | External | 10.10.5.23 | Initial Access (Phishing) | Email log + HTTP download |
| 01:25 | 10.10.5.23 | Local | Credential Dumping | LSASS access (Sysmon EID 10) |
| 01:32 | 10.10.5.23 | 10.10.20.15 | Pass-the-Hash (SMB) | EID 4624 Type 3 NTLM |
| 01:38 | 10.10.5.23 | 10.10.20.16 | PsExec | EID 7045 + Zeek SMB |
| 01:45 | 10.10.20.16 | 10.10.20.17 | RDP | EID 4624 Type 10 |
| 02:00 | 10.10.20.17 | 10.10.20.15 | PsExec (triggered alert) | EID 7045 |
| 02:10 | 10.10.5.23 | 203.0.113.50 | Data Exfiltration | Zeek conn.log 2.3 GB |
### Affected Systems
- 10.10.5.23 (workstation-045) - Initial compromise
- 10.10.20.15 (file-server-01) - Data accessed
- 10.10.20.16 (app-server-02) - Pivoted through
- 10.10.20.17 (db-server-01) - Final target
### Detection Gaps
1. Initial phishing email not blocked by email gateway
2. Credential dumping not detected (no LSASS monitoring)
3. 30-minute gap between first lateral movement and alert
