Understanding and investigating lateral movement techniques
Lateral movement refers to the techniques that an attacker conducts after gaining initial access to a system and discovering the victim's network, to pivoting from the compromised machine to another machine in the same network to search for sensitive data and high-value systems. To move from one machine to another, the attacker must use one of several lateral movement techniques, such as the remote desktop application, PowerShell remoting, the PsExec tool, remote admin share, or creating a remote service or scheduled task. In this section, we will discuss these lateral movement techniques and how to investigate them, by analyzing the Windows event logs recorded on both source and target machines.
In this section, we will deep dive into the following list of lateral movement techniques:
- Remote Desktop application
- Windows admin shares
- The PsExec Sysinternals tool
- PowerShell remoting
