mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
47 lines
2.9 KiB
YAML
47 lines
2.9 KiB
YAML
name: Active Directory Lateral Movement
|
|
id: 399d65dc-1f08-499b-a259-aad9051f38ad
|
|
version: 3
|
|
date: '2021-12-09'
|
|
author: David Dorsey, Mauricio Velazco Splunk
|
|
description: Detect and investigate tactics, techniques, and procedures around how
|
|
attackers move laterally within an Active Directory environment. Since lateral movement
|
|
is often a necessary step in a breach, it is important for cyber defenders to deploy
|
|
detection coverage.
|
|
narrative: "Once attackers gain a foothold within an enterprise, they will seek to\
|
|
\ expand their accesses and leverage techniques that facilitate lateral movement.\
|
|
\ Attackers will often spend quite a bit of time and effort moving laterally. Because\
|
|
\ lateral movement renders an attacker the most vulnerable to detection, it's an\
|
|
\ excellent focus for detection and investigation.\\\nIndications of lateral movement\
|
|
\ in an Active Directory network can include the abuse of system utilities (such\
|
|
\ as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares,\
|
|
\ WMI, PowerShell, Service Control Manager, the DCOM protocol, WinRM or the abuse\
|
|
\ of scheduled tasks. Organizations must be extra vigilant in detecting lateral\
|
|
\ movement techniques and look for suspicious activity in and around high-value\
|
|
\ strategic network assets, such as Active Directory, which are often considered\
|
|
\ the primary target or \"crown jewels\" to a persistent threat actor.\\\nAn adversary\
|
|
\ can use lateral movement for multiple purposes, including remote execution of\
|
|
\ tools, pivoting to additional systems, obtaining access to specific information\
|
|
\ or files, access to additional credentials, exfiltrating data, or delivering a\
|
|
\ secondary effect. Adversaries may use legitimate credentials alongside inherent\
|
|
\ network and operating-system functionality to remotely connect to other systems\
|
|
\ and remain under the radar of network defenders.\\\nIf there is evidence of lateral\
|
|
\ movement, it is imperative for analysts to collect evidence of the associated\
|
|
\ offending hosts. For example, an attacker might leverage host A to gain access\
|
|
\ to host B. From there, the attacker may try to move laterally to host C. In this\
|
|
\ example, the analyst should gather as much information as possible from all three\
|
|
\ hosts. \\\n It is also important to collect authentication logs for each host,\
|
|
\ to ensure that the offending accounts are well-documented. Analysts should account\
|
|
\ for all processes to ensure that the attackers did not install unauthorized software."
|
|
references:
|
|
- https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html
|
|
- http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco
|
|
tags:
|
|
analytic_story: Active Directory Lateral Movement
|
|
category:
|
|
- Adversary Tactics
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|