<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-lateral-movement-in-networks
description: >-
  Detect lateral movement via SMB, RDP, WMI, and credential-based techniques through network traffic analysis, authentication logs, and behavioral detection.
domain: cybersecurity
subdomain: network-security
tags:
  - lateral-movement
  - smb
  - rdp
  - wmi
  - pass-the-hash
  - detection-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021", "T1550.002", "T1047", "T1570"]
---

# Detecting Lateral Movement in Networks

## Overview

Lateral movement detection requires correlation across authentication logs, network flow data, and endpoint telemetry. No single signal is sufficient — attackers abuse legitimate protocols. The detection strategy is behavioral: who is connecting to what, from where, at what time, using what credentials.

Mode: `[MODE: BLUE]` — Every detection rule needs a corresponding evasion consideration.

## Protocol Detection Matrix

| Protocol | Port | ATT&CK | Detection Signal | Evasion |
|---|---|---|---|---|
| SMB | 445 | T1021.002 | Workstation-to-workstation connections | Encrypted SMB3 |
| RDP | 3389 | T1021.001 | Internal host initiating RDP (not jumpbox) | VPN tunneling |
| WMI | 135, dynamic | T1047 | `wmiprvse.exe` spawning child processes | WMI over DCOM tunneling |
| WinRM/PS Remoting | 5985/5986 | T1021.006 | PowerShell remote sessions | WSMan over HTTPS |
| SSH | 22 | T1021.004 | Internal server-to-server SSH chains | SOCKS proxy |
| PsExec/SC | 445 | T1570 | Service installation via network | Custom tool, renamed binary |

## Detection Rules (Sigma)

```yaml
title: Detect Lateral Movement — Workstation-to-Workstation SMB
id: 3f1c2e4a-5b6d-7890-abcd-ef1234567890
status: experimental
description: Detects SMB connections between workstations (non-server assets), a common lateral movement pattern not seen in normal operations.
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 445
    Initiated: 'true'
  filter_servers:
    DestinationHostname|contains:
      - 'srv'
      - 'server'
      - 'dc'
  condition: selection and not filter_servers
falsepositives:
  - Domain controller replication, legitimate file sharing
level: medium
tags:
  - attack.t1021.002
  - attack.lateral_movement
```

## Authentication Anomaly Indicators

| Signal | Log Source | Query Pattern |
|---|---|---|
| Pass-the-Hash | Windows Security EID 4624 | `LogonType=3 AND AuthPackage=NTLM AND AccountType=User` |
| Kerberoasting spike | Windows Security EID 4769 | `TicketEncType=0x17 AND count > 5 in 1min` |
| Admin share access | Windows Security EID 5140 | `ShareName=ADMIN$ OR C$` |
| New service install | Windows System EID 7045 | Within 5 min of SMB connection from same src |
| Failed then success | Windows Security EID 4625+4624 | Same account, 3+ failures then success within 1min |

## Network Baseline Thresholds

| Traffic Pattern | Baseline | Anomaly Threshold | Action |
|---|---|---|---|
| Unique internal SMB destinations per host/day | 1-3 | >10 | Alert + investigate |
| RDP sessions initiated by workstations | 0 | Any | Alert |
| WMI remote process creation | 0-2 admin hosts | Any non-admin | Alert |
| New internal SSH paths | Documented only | Any undocumented | Alert |

## Workflow

1. Enable process creation and network connection logging (Sysmon EID 1, 3)
2. Baseline normal SMB/RDP/WMI traffic per host type (server vs workstation)
3. Deploy detection rules for cross-workstation SMB, non-jumpbox RDP, WMI child processes
4. Correlate authentication events (4624, 4625, 4769) with network connections by source IP
5. Alert on new internal network paths not in baseline (graph anomaly)
6. Hunt for service installations within 5 min of SMB connections from same source

## Related Techniques

- [Implementing Zero Trust Network Access](../implementing-zero-trust-network-access/SKILL.md)
- [Performing Network Security Monitoring](../analyzing-netflow-data/SKILL.md)
