← All cheat sheets

LATERAL MOVEMENT DETECTION

Plain-text reference · 6 KB. Read it, search it (Ctrl-F) or print it.

How a SOC detects an adversary moving host-to-host inside a Windows network,
and WHICH logs reveal each technique. Defensive detection reference mapped to
MITRE ATT&CK (Lateral Movement = TA0008). Baseline normal admin behavior
before alerting -- all of these have legitimate uses.

TELEMETRY YOU NEED#

- Windows Security log (DCs + endpoints): 4624/4625/4648/4672, 4768/4769,
  5140/5145, 4698, 7045/4697.
- Sysmon: 1 (process), 3 (network), 7 (image load), 8 (remote thread),
  10 (process access, esp. to lsass), 11 (file create), 17/18 (named pipes),
  19/20/21 (WMI), 22 (DNS).
- EDR process-tree + network telemetry.
- Network: Zeek (smb, dce_rpc, kerberos, rdp), NetFlow, firewall.
- PowerShell 4104 (script block), WinRM/Operational, TaskScheduler/Operational.

1. SMB / ADMIN SHARES (ATT&CK T1021.002)#

What to look for:
- Access to ADMIN$, C$, IPC$ from a workstation to many hosts.
- Files written to \\host\ADMIN$ or \\host\C$ (tool staging).
Logs/fields:
- Security 5140/5145 (share access; 5145 shows ShareName + RelativeTargetName).
- Security 4624 LogonType 3 on the TARGET, with the source IP.
- Sysmon 11 (file create) under \Windows\ from a remote write.
- Zeek smb_files.log / smb_mapping.log.
Signal: one source IP touching ADMIN$/C$ across many hosts in a short window.

2. PSEXEC-LIKE REMOTE SERVICE EXECUTION (ATT&CK T1021.002 / T1569.002)#

Pattern: a service is created on the remote host to run a payload.
Logs/fields:
- System 7045 "A new service was installed" (random/short service name,
  ImagePath in temp or a command line) -- classic signal.
- Security 4697 (service installed, if audited); 4624 Type 3 preceding it.
- Sysmon 1: services.exe spawning cmd.exe/powershell.exe (service child).
- Sysmon 17/18: named pipes (PsExec uses a pipe; many C2 tools use named
  pipes with recognizable/odd names).
Signal: 7045 with a non-standard service name + child shell, from a remote
logon seconds earlier.

3. RDP (ATT&CK T1021.001)#

Logs/fields:
- Security 4624 LogonType 10 (RemoteInteractive) + source IP; 4625 Type 10
  bursts = RDP brute force.
- Security 4778/4779 (session reconnect/disconnect).
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational (21/25
  logon, 24 disconnect) and -RemoteConnectionManager/Operational (1149).
- Zeek rdp.log.
Signal: RDP from a workstation to servers, chains of host->host RDP, or RDP
from an account that never uses it, off-hours.

4. WINRM / POWERSHELL REMOTING (ATT&CK T1021.006)#

Pattern: Enter-PSSession / Invoke-Command over WS-Man (5985/5986).
Logs/fields:
- Security 4624 Type 3 with authentication to the target.
- Microsoft-Windows-WinRM/Operational events.
- Sysmon 1: wsmprovhost.exe on the TARGET spawning commands.
- PowerShell 4104 on the target (remote script blocks).
- Network: connections to tcp/5985 (HTTP) or 5986 (HTTPS).
Signal: wsmprovhost.exe as parent of cmd/powershell; unexpected WinRM to many
hosts.

5. WMI REMOTE EXECUTION (ATT&CK T1047)#

Pattern: wmic /node: ... process call create, or Invoke-WmiMethod / CIM.
Logs/fields:
- Sysmon 1: WmiPrvSE.exe spawning cmd.exe/powershell.exe/script hosts.
- Microsoft-Windows-WMI-Activity/Operational (5857/5858/5860/5861).
- Security 4624 Type 3 on the target around the time.
- Sysmon 19/20/21 for WMI event-subscription persistence (not execution but
  often paired).
Signal: WmiPrvSE.exe as parent of a shell/scripting process.

6. REMOTE SCHEDULED TASKS (ATT&CK T1053.005)#

Pattern: schtasks /create /s <remotehost> ... or ATSvc/SchRpc over RPC.
Logs/fields:
- Security 4698 (scheduled task created) on the TARGET + 4624 Type 3.
- Microsoft-Windows-TaskScheduler/Operational 106/140/200.
- Sysmon 1: taskeng.exe/svchost launching the task action.
Signal: task created remotely, action runs a shell/LOLBin, triggers at
logon/once soon after creation.

7. KERBEROS / CREDENTIAL ANOMALIES (ATT&CK T1550 / T1558)#

Pass-the-Hash (T1550.002):
- 4624 Type 3 with NTLM where Kerberos is expected; 4776 on the DC; no
  preceding 4768 (TGT) for that session. Sysmon 10 access to lsass.exe
  (credential dumping precursor).
Pass-the-Ticket (T1550.003):
- Logons without the expected AS-REQ; ticket reuse from unusual hosts.
Kerberoasting (T1558.003):
- 4769 (TGS requests) in volume for many SPNs from one host, often with
  RC4 (encryption type 0x17) requested -- baseline normal 4769 first.
Overpass-the-hash / anomalies:
- RC4 where AES is standard; TGT requests from hosts that shouldn't.

ANALYST WORKFLOW#

1. Pivot on the suspect account/host: pull 4624 (types 3/10) with source IPs.
2. Build a graph: which SOURCE authenticated to which TARGETS, when.
3. For each target, look for the execution signal (7045, WmiPrvSE/wsmprovhost
   children, 4698, remote service) in the same time window.
4. Check for credential access on the source (Sysmon 10 -> lsass, 4769 bursts).
5. Expand to every host the account touched; contain accounts + hosts.

BASELINE / TUNING#

- Legitimate admin tools (SCCM, patching, RMM, monitoring) do all of the
  above constantly. Allowlist known admin jump hosts and service accounts,
  then alert on DEVIATIONS: new source->target pairs, workstation-to-
  workstation admin auth, off-hours, or unusual accounts.

and Sysmon documentation.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.