Quick Start: Why Lateral Movement Matters
Initial access is rarely the end goal. Once an attacker lands on a single workstation—perhaps through a phishing link—the clock starts ticking. They don’t stay put. They immediately begin exploring your network to find high-value assets like Domain Controllers or SQL databases. This phase is known as Lateral Movement.
Standard perimeter firewalls are blind to this. They watch “North-South” traffic (internet to internal), but ignore the “East-West” traffic moving between your servers. To catch a human operator moving through your environment, you need visibility into three specific layers:
- The Host: What processes are running and who is logging in? (osquery).
- The Wire: What protocols are moving between internal IPs? (Zeek).
- The Logic: How do we standardize alerts across different log sources? (Sigma Rules).
You shouldn’t expect to block every initial breach. Instead, aim to make your internal network so transparent that an attacker cannot take a single step without tripping a wire.
Deep Dive: Building the Detection Stack
Effective monitoring requires a mindset shift. I stopped chasing specific malware signatures years ago. Now, I look for “administrative tools used in the wrong place at the wrong time.”
1. Host-Level Visibility with osquery
Osquery transforms your operating system into a searchable database. You don’t have to dig through cryptic Windows Event Logs. Instead, you run SQL queries to find anomalies in real-time. Attackers often move by installing remote services or hijacking scheduled tasks.
I use this query to flag new services that bypass standard naming conventions or hide in temporary folders:
SELECT name, display_name, path, start_type
FROM services
WHERE start_type = 'SERVICE_AUTO_START'
AND path NOT LIKE 'C:\Windows\System32\%'
AND path LIKE '%\Temp\%';If you see a service named “SystemUpdate” running a binary out of C:\Users\Public\, you are likely looking at a command-and-control beacon or a tool like PsExec.
2. Network Metadata with Zeek
Zeek isn’t a traditional IDS; it’s a powerful metadata engine. It doesn’t just tell you that a connection happened. It records exactly what occurred during that connection. For lateral movement, focus on smb_files.log and ntlm.log.
Attackers rely on SMB (Server Message Block) to move laterally. A typical user might connect to two or three file shares a day. If Zeek shows a single workstation attempting 50+ SMB connections to unique internal IPs within 60 seconds, it’s a definitive red flag. This behavior often indicates automated scanning via tools like CrackMapExec or BloodHound.
3. Hardening Credentials
Detection is vital, but friction is better. A common mistake is using identical local administrator passwords across an entire fleet. If one machine falls, they all fall. When I provision new servers, I ensure every local admin account has a unique, high-entropy password.
For quick, secure generation, I use the tool at toolcraft.app/en/tools/security/password-generator. It runs entirely in your browser, ensuring no sensitive data touches the wire. While tools like Microsoft LAPS are the gold standard for enterprises, having a zero-knowledge generator for standalone systems prevents a single compromised credential from becoming a skeleton key for your network.
Advanced Correlation with Sigma Rules
Data from osquery and Zeek is only useful if you can analyze it. Sigma provides a vendor-neutral language for detection. It allows you to write a rule once and apply it to Splunk, ELK, or Microsoft Sentinel.
Detecting WMI Execution
Windows Management Instrumentation (WMI) is a favorite for “Living off the Land.” It’s built-in, powerful, and often overlooked. Here is a Sigma rule to catch WMI being used to spawn processes on remote systems:
title: Remote WMI Process Creation
status: stable
description: Detects wmic.exe creating processes on remote nodes.
logsource:
product: windows
service: security
detection:
selection:
EventID: 4688
CommandLine|contains|all:
- 'wmic'
- '/node:'
- 'process call create'
condition: selection
level: highThis rule targets the specific command-line arguments used by attackers to execute code remotely without ever dropping a traditional virus file on the disk.
Identifying SSH Tunneling
In Linux environments, movement usually happens via SSH. I look for “Long-Lived, Low-Volume” sessions. An SSH connection that stays open for 12 hours but transfers less than 5MB of data is often a reverse shell or a persistent command-and-control tunnel.
Practical Tips from the Field
After years of incident response, these three strategies consistently provide the best results:
1. Shrink the Blast Radius
Assume your workstations are already compromised. Use host-based firewalls to prevent workstations from talking to each other directly. A laptop in the Marketing department has no business initiating an RDP connection (Port 3389) to a laptop in Accounting. If that happens, your SIEM should trigger an immediate alert.
2. Watch for “Pass-the-Hash”
Monitor your NTLM logs closely. If you have migrated your environment to Kerberos, any sudden spike in NTLM authentication is suspicious. It often indicates an attacker using Mimikatz to authenticate using a password hash they harvested from memory, bypassing the need for the actual cleartext password.
3. Establish a Baseline
You cannot identify “abnormal” if you don’t know what “normal” looks like. Spend two weeks observing your network’s heartbeat. Note which service accounts log in at 2:00 AM and which scripts run periodically. Once you whitelist these known administrative tasks, the manual, stumbling commands of a human hacker will become obvious.
Final Thoughts
Don’t try to boil the ocean. Start small by deploying osquery to your five most critical servers. Add Zeek to your core switch to monitor traffic to your data center. By combining host-level SQL queries with network metadata and Sigma rules, you turn your network into a well-lit environment where attackers have nowhere to hide.
