Detecting Lateral Movement

name: detecting-lateral-movement description: >- Detect adversary lateral movement across Windows and Linux environments. Covers PsExec, WMI, RDP, SSH, SMB, WinRM, and DCOM abuse with Sigma rules, KQL/SPL queries, and network-based detection strategies. domain: cybersecurity subdomain: blue-team tags: - lateral-movement - detection-engineering - threat-hunting - mitre-attack - windows - network-security version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1021.001", "T1021.002", "T1021.003", "T1021.004", "T1021.006", "T1550.002"]

Detecting Lateral Movement

Overview

Lateral movement (MITRE ATT&CK Tactic TA0008) allows adversaries to pivot through a network after initial access. Detection requires correlating authentication events, service creation, network connections, and process execution across multiple hosts and log sources.

Prerequisites

Key Concepts

Lateral Movement Techniques

PsExec Detection (Sigma)

title: PsExec Service Installation
id: c3f7a8d2-1b4e-4f6a-9d2c-8e7f5a3b6c1d
status: experimental
description: Detects PsExec service installation indicating lateral movement
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'psexec'
  condition: selection
falsepositives:
  - Legitimate admin use of PsExec with documented change ticket
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002

WMI Lateral Movement Detection (KQL)

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "wmiprvse.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "mshta.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine,
    InitiatingProcessCommandLine
| join kind=inner (
    DeviceLogonEvents
    | where LogonType == "Network"
    | where Timestamp > ago(24h)
) on DeviceName
| project Timestamp, DeviceName, RemoteIP, FileName, ProcessCommandLine

RDP Lateral Movement Detection (SPL)

index=windows (EventCode=4624 Logon_Type=10)
| stats earliest(_time) as first_rdp, latest(_time) as last_rdp,
    dc(dest) as dest_count, values(dest) as destinations by src_ip, user
| where dest_count > 2
| eval first_rdp=strftime(first_rdp, "%Y-%m-%d %H:%M:%S")
| sort -dest_count

Network-Based Detection

title: SMB Lateral Movement - Unusual Internal SMB Traffic
id: d4e8f9a1-2c5b-4d7e-8f3a-9b6c1d2e5f4a
status: experimental
description: Detects workstation-to-workstation SMB connections outside baseline
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 445
    Initiated: 'true'
  filter_servers:
    DestinationIp|cidr:
      - '10.0.1.0/24'
  condition: selection and not filter_servers
falsepositives:
  - Peer-to-peer file sharing in flat networks
level: medium
tags:
  - attack.lateral_movement
  - attack.t1021.002

Multi-Hop Detection Pattern

// Detect chains: Host A -> Host B -> Host C
DeviceLogonEvents
| where Timestamp > ago(24h)
| where LogonType == "Network"
| project SourceHost = RemoteDeviceName, DestHost = DeviceName,
    User = AccountName, T = Timestamp
| join kind=inner (
    DeviceLogonEvents
    | where LogonType == "Network"
    | project SourceHost2 = RemoteDeviceName, DestHost2 = DeviceName,
        User2 = AccountName, T2 = Timestamp
) on $left.DestHost == $right.SourceHost2
| where T2 > T and datetime_diff('minute', T2, T) < 30
| where User == User2
| project T, User, Hop1_Src = SourceHost, Hop1_Dest = DestHost,
    Hop2_Dest = DestHost2

Workflow

1. Baseline — Map normal admin tool usage and approved remote access paths
2. Monitor — Deploy detections for each lateral movement technique
3. Correlate — Link authentication events to process creation on destination
4. Hunt — Search for multi-hop chains and unusual source-destination pairs
5. Contain — Isolate compromised hosts via EDR or VLAN reassignment
6. Update — Feed findings back into detection rules

Verification

References

• MITRE ATT&CK Lateral Movement
• SANS Lateral Movement Detection
• Sigma Lateral Movement Rules