Lateral Movement Detection in Logs

What This Means

Detect lateral movement across your network by analyzing authentication, process, and network logs. Identify PsExec, WMI, RDP, and other techniques attackers use to spread through environments.

Example Log

-- Lateral movement evidence across multiple event types:
[4624] jsmith Type 3 (Network) on SERVER02 from 10.0.5.142
[4688] cmd.exe /c "net view \\SERVER03" on SERVER02 by jsmith
[4648] Explicit creds: jsmith using svc_admin to SERVER03
[4624] svc_admin Type 3 on SERVER03 from SERVER02 (10.0.5.50)
[4688] powershell.exe on SERVER03 by svc_admin: Invoke-Command -ComputerName SERVER04

Indicators of Suspicious Activity

• Admin account authenticating to multiple servers in rapid succession
• Type 3 (network) logons from workstations to servers outside normal patterns
• PsExec-style execution: services.exe spawning cmd.exe on remote systems
• WMI execution: wmiprvse.exe spawning processes on remote systems
• Explicit credential use (Event 4648) to authenticate as different accounts
• Remote PowerShell sessions (WinRM) from non-admin workstations

How to Investigate

1. Map the authentication chain: trace the account from initial logon through each hop
2. Identify the pivot point — the first compromised system used for lateral movement
3. Check for credential harvesting activity before the movement (Event 4672 + 4688 with Mimikatz indicators)
4. Determine which accounts are being used (user accounts, service accounts, admin accounts)
5. Assess the scope — how many systems were accessed during the movement
6. Check for data staging or exfiltration at the endpoints of the movement chain

Recommended Mitigations

• Implement network segmentation with micro-segmentation for critical assets
• Deploy Privileged Access Workstations (PAWs) and enforce tiered admin access
• Enable credential guard on all endpoints to prevent hash extraction
• Restrict lateral administrative access — admin workstations should not connect to user systems
• Monitor for and alert on Type 3 logons between workstations (peer-to-peer is abnormal)
• Implement LAPS for local admin passwords to prevent hash reuse

Related Attack Patterns

Frequently Asked Questions