performing-lateral-movement-detection

# Performing Lateral Movement Detection ## When to Use Use this skill when: - SOC teams need to detect attackers pivoting between systems after initial compromise - Incident investigations require tracking an attacker's movement path through the network - Detection engineering needs lateral movement rules mapped to ATT&CK TA0008 techniques - Red/purple team exercises identify lateral movement detection gaps **Do not use** for detecting initial access or external attacks — lateral movement detection focuses on internal host-to-host pivot activity. ## Prerequisites - Windows Security Event Logs (EventCode 4624, 4625, 4648, 4672) from all endpoints and servers - Sysmon deployed with process creation (EventCode 1), network connections (EventCode 3), and named pipe (EventCode 17/18) - Network flow data (NetFlow/sFlow, Zeek connection logs) for internal traffic analysis - SIEM with cross-source correlation capability - Baseline of normal internal authentication patterns ## Workflow ### Step 1: Detect Pass-the-Hash / Pass-the-Ticket (T1550) **Pass-the-Hash Detection (EventCode 4624 with NTLM):** ```spl index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3 AuthenticationPackageName="NTLM" | where TargetUserName!="ANONYMOUS LOGON" AND TargetUserName!="$" | stats count, dc(ComputerName) AS unique_targets, values(ComputerName) AS targets by src_ip, TargetUserName | where unique_targets > 3 | eval alert = "Possible Pass-the-Hash: NTLM network logon to ...