Full Report
Huntress explains lateral movement attacks, how attackers move through networks, common techniques like pass-the-hash, and how Managed EDR stops lateral movement.
Analysis Summary
# Tool/Technique: Lateral Movement
## Overview
Lateral movement refers to the techniques that adversaries use to navigate through a network environment after gaining an initial foothold. The primary purpose is to pivot from a compromised host to other systems to locate high-value assets, such as domain controllers or sensitive data stores, and to establish persistence.
## Technical Details
- **Type**: Technique (Adversary Tactic)
- **Platform**: Windows (Primary focus of the context), Multi-platform
- **Capabilities**: Remote code execution, credential harvesting, network mapping, and service manipulation.
- **First Seen**: N/A (Fundamental component of network intrusions)
## MITRE ATT&CK Mapping
- **TA0008 - Lateral Movement**
- **T1021.001** - Remote Services: Remote Desktop Protocol
- **T1021.006** - Remote Services: Windows Remote Management (PowerShell Remoting)
- **T1210** - Exploitation of Remote Services
- **T1570** - Lateral Tool Transfer
- **T1021.002** - Remote Services: SMB/Windows Admin Shares
- **TA0007 - Discovery**
- **T1018** - Remote System Discovery
- **TA0006 - Credential Access**
- **T1550.002** - Use Alternate Authentication Material: Pass the Hash
## Functionality
### Core Capabilities
* **Remote Interaction**: Utilizing built-in protocols like RDP, SMB, and DCOM to interact with remote file systems or desktops.
* **Remote Management**: Leveraging PowerShell Remoting (WinRM) and WMI to execute commands across the network.
* **Service Execution**: Creating or modifying Windows Services and Scheduled Tasks on remote hosts to trigger code execution.
* **Authentication Abuse**: Using legitimate credentials or authentication tokens (Pass-the-Hash) to impersonate authorized users.
### Advanced Features
* **Living-off-the-Land (LotL)**: Using native Windows administrative tools (e.g., `net.exe`, `sc.exe`, `powershell.exe`) to blend in with normal administrator activity.
* **Credential Harvesting**: Extracting plain-text passwords or NTLM hashes from memory (LSASS) to facilitate further hops.
* **Layered Telemetry Collection**: Monitoring server-side indicators rather than just client-side process creation to reduce false positives.
## Indicators of Compromise
* **File Names**: `mimikatz.exe`, `psexec.exe`
* **Registry Keys**:
* `HKLM\System\CurrentControlSet\Control\Lsa` (Modifications for credential dumping)
* `HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System` (LocalAccountTokenFilterPolicy adjustments)
* **Network Indicators**:
* Anomalous SMB traffic (Port 445) between workstations.
* Internal RDP connections (Port 3389) coming from non-admin workstations.
* **Behavioral Indicators**:
* Unexpected service installation via `services.exe`.
* Rapid authentication attempts from a single source to multiple destinations.
* `wsmprovhost.exe` spawning suspicious child processes (PowerShell Remoting).
## Associated Threat Actors
* **General Adversaries**: Nearly all sophisticated threat groups (APTs) and ransomware operators utilize these techniques.
* **Specific mentions in context**: "November Case" actors, Potemkin Loader operators.
## Detection Methods
* **Behavioral Detection**: Monitoring for "action pillars"—identifying the transition between network connection, authentication, and subsequent remote command execution.
* **Log Analysis**: Reviewing Windows Event Logs for Event ID 4624 (Successful Logon) with Logon Type 3 (Network) or Type 10 (RemoteInteractive).
* **Managed EDR**: Using real-time monitoring to identify deviations from baseline administrative behavior.
## Mitigation Strategies
* **Credential Hygiene**: Implementing LAPS (Local Administrator Password Solution) to ensure unique local admin passwords.
* **Network Segmentation**: Restricting lateral communication between workstations; only allowing administrative protocols from designated "Jump Boxes."
* **Least Privilege**: Disabling RDP and PowerShell Remoting on hosts where it is not strictly required for business functions.
* **Hardening**: Enabling Protected Process Light (PPL) for LSASS to prevent credential dumping.
## Related Tools/Techniques
* **Mimikatz**: For credential theft.
* **PsExec**: For remote service execution.
* **Cobalt Strike**: Framework often used to automate lateral movement.
* **BloodHound**: For mapping attack paths and identifying high-value targets.