What is lateral movement?¶
Lateral movement is activity used to move from one account, device or system to another within an environment.
Avoid the dangerous assumption¶
The dangerous assumption is that access to one device proves access to the wider network.
It does not.
An offender may use the first foothold to reach:
- other workstations
- servers
- cloud services
- file shares
- administrative systems
- identity platforms
- backup systems
- security tools
- other user accounts.
Possible methods include stolen credentials, remote services, shared administrative tools, pass-the-hash, remote command execution, network shares and compromised management platforms.
Investigators should establish:
- the starting system or account
- the target system
- the access method
- the account or credential used
- the time
- whether access succeeded
- what activity followed.
Relevant evidence may exist in authentication logs, endpoint records, remote-service logs, network connections, directory events, management platforms and cloud audit data.
A connection attempt is not the same as successful access.
A successful login is not the same as control of the target system.
Access to one target does not prove movement to every connected system.
Do not assume that the source device owner personally performed the movement. The device may have been remotely controlled or automated.
Likewise, legitimate administrators may move between systems using the same tools.
Where movement spans on-premises and cloud systems, preserve the transition point. A local account may be used to reach a browser session, while a cloud token or federated identity then carries the activity into another environment.
Operational takeaway¶
Reconstruct lateral movement as a sequence from source to target, and prove the method, success and resulting activity for each system separately.