What evidence may show movement between systems?¶
The practical answer¶
Movement between systems is best shown by linked evidence from both the source and the target.
The key evidential caution¶
The dangerous assumption is that one connection record proves complete lateral movement.
It may not.
Relevant evidence¶
Useful evidence may include:
Key points¶
- source authentication attempts
- target login events
- remote-service sessions
- process creation
- network connections
- file transfers
- service or task creation
- directory events
- management-platform commands
- shared session or correlation identifiers
Evidence to preserve¶
Investigators should preserve:
Key points¶
- the exact timestamps and time zones
- source and target host identifiers
- account names and stable IDs
- protocol or service
- session identifiers
- command or file activity
- success or failure results
The strongest evidence often comes from correlation.
A source device records a remote command.
The target records authentication and process execution.
A file appears on the target immediately afterwards.
That sequence is stronger than any one event alone.
Account for clock differences, retries, gateways and relays.
Evidential limits¶
Do not force events together merely because they are close in time.
Likewise, the absence of one side’s log may reflect retention or coverage gaps rather than prove no movement occurred.
Practical interpretation¶
Where one side of the movement is missing, preserve the known event and state the limitation. A target login without a source record may still be significant, but the route and controller may remain uncertain.
Corroborating process, file or account activity may still narrow the inference.
A supported movement path may therefore remain possible without being fully reconstructed.
Operational takeaway¶
Correlate source, target, account, session and process evidence to show the path of movement and the result on each system.