How to Detect and Stop Lateral Movement Attacks

TL;DR

Detect lateral movement by correlating artifacts from the source system, destination system, and network, with special attention to credential theft, reconnaissance commands, remote execution, and unusual scheduled tasks. Defenders should threat-model likely attack paths, monitor suspicious use of native Windows tools, and complete the observe, orient, decide, and act cycle faster than attackers.

Transcript

All right, welcome. Uh, my name is Jonathan Trull, and I am the, uh, vice president and CISO for Optiv. Uh, I'm happy to, uh, talk to you today about a topic that is, uh, near and dear to my heart and, uh, something that I think everyone needs to be aware of as they develop out their security programs. Uh, but today I'll be talking to you, uh, abou... Read More

Key Insights

• A pivot is the moment when an attacker begins using an initial compromise to target other systems inside a network. The attacker moves laterally because the first compromised endpoint typically does not contain the sensitive data required to complete the attack.
• Lateral movement is a repeating process of privilege escalation, internal reconnaissance, movement to another system, and persistence. Attackers continue this loop until they find the desired data, secure sufficient privileges, access the information, and exfiltrate it from the organization.
• Attackers can remain inside a network for long periods, with the presentation citing 356 days for APT1 and an average of 205 days. Meanwhile, a vulnerable organization can be compromised within minutes, and an attack can spread between victims within 24 hours.
• The OODA loop consists of observing, orienting, deciding, and acting. Attackers and defenders both follow this loop, and the side that completes it fastest gains the advantage, making rapid detection and response essential during an attempted pivot.
• Native Windows tools can enable lateral movement while making malicious behavior resemble normal activity. Attackers may use Command Prompt, PowerShell, scheduled tasks, Net Use, Net View, Windows Management Instrumentation, and Remote Desktop rather than relying entirely on clearly recognizable malicious software.
• Credential theft supports most observed lateral movement. Attackers may dump password hashes or Kerberos tickets, obtain the access level needed for remote actions, and then use compromised credentials to execute code, map shares, inspect files, or move to another workstation.
• A pivot leaves evidence on the source machine, destination machine, and network. Locard's exchange principle supports this investigative approach because contact between systems creates traces, so defenders should combine artifacts from all three locations instead of examining a single endpoint in isolation.
• Effective defense requires broad monitoring and focused forensic analysis. Security teams should identify anomalous behavior across large endpoint populations, then investigate the specific systems involved, model likely attack paths, examine unusual script usage, and correlate relevant operating-system and network events.

Questions & Answers

Q: What is a pivot in a cyberattack?

A pivot occurs when an attacker uses access to an initially compromised system to begin targeting other systems inside the same network. The first endpoint usually does not contain the desired sensitive data, so the attacker performs reconnaissance, escalates privileges, steals credentials, moves laterally, establishes persistence, and repeats these activities until the intended information becomes accessible.

Q: Why do attackers move laterally after compromising an endpoint?

Attackers move laterally because the first compromised system typically lacks the data they actually want. They must discover where sensitive information resides, determine which systems or shares can provide access, and obtain the required privileges. They may repeat reconnaissance, credential theft, remote execution, and persistence activities across multiple systems before accessing and exfiltrating the target data.

Q: How long can attackers remain undetected inside a network?

The presentation cites extended periods of attacker access, including 356 days for APT1 and an average of 205 days inside a network. During that time, attackers may move laterally while searching for sensitive data. This lengthy presence contrasts with the speed of initial compromise, which can occur within minutes after a vulnerable system is identified.

Q: What Windows tools can attackers use for lateral movement?

Attackers can use tools already present in Windows environments, including Command Prompt, PowerShell, scheduled tasks through at.exe, Net Use, Net View, and Windows Management Instrumentation. They may also use Remote Desktop when available. Because these capabilities have legitimate purposes, their malicious use can resemble normal user or administrative behavior unless defenders monitor for specific patterns and context.

Q: What reconnaissance commands can indicate an attacker is pivoting?

Reconnaissance can include commands that reveal the current identity, users, systems, domains, administrators, sessions, shares, files, and available hosts. Examples in the presentation include whoami, Net User, Net View, Net Session, and Net File. Attackers may also use ping and port checks to discover live systems and determine which services are listening before choosing their next move.

Q: How do attackers remotely execute code during a pivot?

After obtaining suitable credentials and privileges, attackers may place malware on another system or create scheduled tasks that launch malware, PowerShell scripts, or batch scripts. They can also use Remote Desktop, Windows Management Instrumentation, PsExec, Netcat, or the Metasploit framework. Scheduled tasks may execute under the system context, which is an important indicator for defenders to examine.

Q: Where should defenders look for evidence of lateral movement?

Defenders should examine three locations: the source machine, the destination machine, and the network connecting them. Lateral movement necessarily involves a source and destination, and both systems can retain artifacts of their interaction. Network observations provide another perspective. Correlating these traces produces stronger indicators than reviewing operating-system or network evidence separately.

Q: How can organizations defend against attacker pivoting?

Organizations should establish indicators of pivoting, correlate relevant event logs, look for unusual use of scripts and native tools, and model how attackers could move through the deployed technology environment. Broad monitoring can reveal anomalous behavior across many endpoints, while focused forensic analysis of the involved source and destination systems can confirm the activity and guide a timely response.

Summary & Key Takeaways

• Attackers usually pivot because the initially compromised endpoint does not contain their desired data. They escalate privileges, conduct internal reconnaissance, steal credentials, move to additional systems, and maintain persistence. This process can repeat as a loop until they locate sensitive information, obtain sufficient access, and exfiltrate that information from the environment.

• Pivoting is difficult to detect because attackers frequently use legitimate Windows capabilities, including Command Prompt, PowerShell, scheduled tasks, Net Use, Net View, Windows Management Instrumentation, and Remote Desktop. Compromised credentials are common, and the resulting actions may resemble ordinary user or administrator behavior unless defenders know which artifacts to correlate.

• Defending against lateral movement requires both broad monitoring across many endpoints and detailed forensic investigation of particular systems. Teams should model how an attacker could traverse their specific technology environment, identify suspicious script and tool usage, and combine operating-system logs, source-host evidence, destination-host evidence, and network activity into reliable indicators of a pivot.