<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-lateral-movement-via-identity
description: >-
  Detect lateral movement through identity-based techniques including credential relay, token impersonation, session hijacking, RDP/SSH pivoting, and service account abuse across hybrid environments. Covers authentication chain analysis, network-identity correlation, and identity-aware microsegmentation validation.
domain: cybersecurity
subdomain: identity-security
tags:
  - lateral-movement
  - credential-relay
  - token-impersonation
  - session-hijacking
  - authentication-chain
  - identity-correlation
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "DE.CM-1"
  - "DE.CM-3"
  - "DE.CM-7"
  - "DE.AE-1"
  - "DE.AE-3"
  frameworks:
  - "MITRE ATT&CK"
  - "NIST SP 800-53"
  - "Zero Trust Architecture"
  mitre-attack: ["T1550"]
---

# Detecting Lateral Movement Via Identity

## Overview

Lateral movement via identity exploitation is the primary method attackers use
to traverse networks after initial access. By abusing credentials, tokens, and
authentication protocols, adversaries move between systems without triggering
traditional network-based detections. Identity-aware detection correlates
authentication events across systems to reveal movement chains.

## Workflow

1. **Authentication Telemetry Collection** — Aggregate logon events across AD, cloud IdP, PAM, VPN, and application logs
2. **Identity-Network Mapping** — Correlate identity events with network flow data to build movement graphs
3. **Credential Usage Profiling** — Baseline normal credential usage patterns per account and system
4. **Authentication Chain Analysis** — Build sequential logon chains to detect multi-hop lateral movement
5. **Protocol Anomaly Detection** — Monitor for unusual authentication protocol usage (NTLM in Kerberos env, etc.)
6. **Token and Session Tracking** — Detect token theft, replay, and session hijacking across trust boundaries
7. **Service Account Movement Monitoring** — Alert on service accounts authenticating to non-standard destinations
8. **Identity Microsegmentation Validation** — Verify identity-based access controls prevent unauthorized movement

## Key Concepts

### Lateral Movement Identity Techniques

| Technique | ATT&CK ID | Protocol | Detection Vector |
|-----------|----------|----------|-----------------|
| Pass-the-Hash | T1550.002 | NTLM | Type 3 logon with NTLM from unusual source |
| Pass-the-Ticket | T1550.003 | Kerberos | TGT/TGS use from non-original IP |
| Overpass-the-Hash | T1550 | Kerberos | RC4 TGT request after NTLM auth |
| Token Impersonation | T1134.001 | Windows API | Process running as different user |
| RDP Hijacking | T1563.002 | RDP | Session reconnection from new source |
| SSH Pivoting | T1021.004 | SSH | Agent forwarding chain, ProxyJump |
| WMI/WinRM Abuse | T1021.006 | WinRM | Remote process creation patterns |
| DCOM Exploitation | T1021.003 | DCOM | Unusual DCOM object activation |

### Authentication Chain Analysis

| Hop | Source | Protocol | Destination | Indicator |
|-----|--------|----------|-------------|-----------|
| 1 | Workstation A | Kerberos | File Server | Normal access |
| 2 | File Server | NTLM | Domain Controller | Protocol downgrade |
| 3 | Domain Controller | Kerberos | Database Server | DC as source (anomalous) |
| 4 | Database Server | SSH | Linux Host | Cross-platform pivot |

### Identity-Network Correlation Matrix

| Identity Event | Network Event | Combined Indicator |
|---------------|--------------|-------------------|
| 4624 Type 3 logon | SMB connection | File share lateral movement |
| 4624 Type 10 logon | RDP connection | Interactive remote access |
| 4648 explicit creds | New TCP connection | Credential-based pivot |
| SSH auth success | New session from jump host | SSH chain movement |

## Detection Opportunities

### Detection Rules

**Multi-Hop Lateral Movement (KQL)**:
```
SecurityEvent
| where EventID == 4624 and LogonType in (3, 10)
| summarize Targets=make_set(Computer), HopCount=dcount(Computer) by Account, bin(TimeGenerated, 1h)
| where HopCount > 3
| sort by HopCount desc
```

**NTLM in Kerberos Environment (SPL)**:
```
index=wineventlog EventCode=4624 LogonType=3 AuthenticationPackageName=NTLM
| stats count by Account_Name, Source_Network_Address, Workstation_Name
| where count > 5
| sort -count
```

- **MITRE mapping**: T1550 (Use Alternate Authentication Material), T1021 (Remote Services), T1563 (Remote Service Session Hijacking)

```yaml
title: Lateral Movement Via Identity Detection
id: 55ff1935-1134-41b7-8ce4-d4df6c36fc95
status: experimental
description: Detects suspicious activity related to detecting lateral movement via identity techniques in identity security context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: high
tags:
  - attack.t1550
  - attack.credential_access
falsepositives:
  - Service account authentication during scheduled batch processing
```

