Lateral Movement

Systems Involved

Identify the source and target system involved in the network connection

Account(s) Used

Identify the account used to initiate the connection. Sometimes, there is one account that initiates an action as a second account. This is common in SSH connections.

Type of Connection

Lateral movement threats by definition involve some sort of connection set up between two systems. Identity the connection protocol used. Common examples include:

• remote access, such as SSH and RDP
• file transfer, such as SCP, FTP and SMB
• API, where the remote target is an application

Program used to initiate connection

In many cases of lateral movement, you'll have the ability to identify or infer the tool used to make a connection. Often, the tool will be a common program or utility either preinstalled or installed by a user. Common examples include:

• Web browsers, such as chrome.exe, msedge.exe, and firefox.exe
• Remote access tools such as putty.exe and TeamViewer.exe
• Command shells such as cmd.exe wt.exe
• Scripting Languages, such as python.exe, and powershell.exe

1. How are the accounts involved typically used?

Understanding what the accounts involved in this activity typically do can provide strong indications that this activity is more likely than not to be expected.

• For user accounts: Would that user likely have a need to perform the action?
• For service accounts: Is the action an account is performing related to its assigned service? An account associated with a running application likely shouldn't be relying on a remote access utility to connect to a remote system.
• For system accounts: Most operating systems have a default system account. These accounts typically run necessary OS processes.

2. Was the connection initiated interactively or not?

Interactive actions are ones taken by a person who is often typing commands or using GUI applications. Reviewing command histories or process trees can often indicate if a person is interacting with the system or if some programmatic process is initiating activity. One giveaway is if a command is being executed too efficiently as it often indicates it wasn't a person typing the commands. People make mistakes and are generally not optimally efficient with their tasks. Often, you'll be more suspicious of programmatic actions, especially if they are actions you don't see happening frequently in your environment.

Additionally, consider if the account was used in an expected way. A user account performing actions programmatically could be suspicious.

If there isn't an obvious reason why this activity is expected, it might be time to either escalate to a more senior analyst or start executing your incident response plan.

Common initial response actions can include:

• Contacting a system owner or user's manager to identify if this activity seems expected.
• Isolating workstations involved from the network.