Using Microsoft Sentinel to Mitigate Lateral Movement Paths

This chapter explains Microsoft Sentinel’s capabilities to detect and investigate advanced security threats, compromised identities, and potentially malicious actions in our organization.

Lateral movement is a technique used by cyber attackers to move across a network once they have gained access to one device. Microsoft Sentinel is a tool that helps to detect and respond to cyber threats.

In this chapter, we will review how organizations can identify suspicious activity and prevent lateral movement by setting up alerts and automated responses to potential threats using Microsoft Sentinel, helping to protect a network from cyberattacks and keep sensitive information safe.

By using Microsoft Sentinel to mitigate lateral movement paths, you can detect and prevent attackers from moving from one device to another within a network. This is important because once an attacker gains access to one device, they can use...

Understanding the Zero Trust strategy

Identity protection has become a central part of adopting a Zero Trust strategy in organizations looking to improve their security posture. Zero Trust, a security model, describes an approach to designing and implementing systems to protect organizations better.

Zero Trust responds to modern enterprise trends that enable remote users, bring-your-own-device policies, and access to cloud-based resources from multiple locations.

Zero Trust principles are verified explicitly, use least-privilege access, assume breach, and focus on protecting resources, including assets, services, workflows, and network accounts. Therefore, a Zero Trust Architecture (ZTA) leverages these zero-trust principles to plan enterprise infrastructure and workflows.

A Zero Trust model provides a holistic security control plane, segmented into multiple layers of defense:

Figure 3.1 – A Zero Trust model and its layers of defense

Let...

Understanding lateral movement

Threat actors or cyber attackers leverage several techniques to search for sensitive data and assets. Lateral movement refers to the technique of gaining initial access to organizational assets and extending access to other hosts or applications in an organization.

After gaining access to a compromised endpoint, the attacker can maintain access, move through the compromised environment, and search for sensitive data and other assets. The attacker can impersonate a legitimate user and access other network resources.

Imagine there’s an employee in your organization, Chris, who opens an email with a malicious attachment. Chris’s computer is compromised, so the threat actor can already start performing enumeration operations and gathering information about the internal systems.

Now, the threat actor can perform reconnaissance or credential or privilege gathering, and gain access to other assets in the network. Detecting and preventing...

Leveraging Microsoft Sentinel to improve your security posture

Microsoft Sentinel, a unified Security Operations (SecOps) platform, focuses primarily on two fronts – SIEM and Security Orchestration, Automation, and Response (SOAR).

Microsoft Sentinel allows data collection across your organization; it detects threats while minimizing false positives by leveraging Microsoft’s analytics and threat intelligence. Organizations can investigate threats, hunt for suspicious activities, and accelerate their response to incidents by using the built-in orchestration and automation components available in Sentinel.

Through Microsoft Sentinel, organizations can protect their critical assets by gaining visibility into security data and performing searches across all their data, including archive logs, investigating historical data, and then transforming data by enriching and filtering it as needed. Microsoft Sentinel provides the right tools for all members of your security...

Enabling Microsoft Sentinel

In this section, we will demonstrate how to configure Microsoft Sentinel, and we will take the following steps:

1. List the prerequisites
2. Enable Microsoft Sentinel using the Bicep language
3. Enable Microsoft Sentinel using the Azure portal
4. Set up data connectors

Let’s review the components we need to configure before enabling Microsoft Sentinel.

Global prerequisites

To successfully enable Microsoft Sentinel, we need the following:

• An active Azure subscription
• A Log Analytics workspace
• A user with contributor role permissions where the Sentinel workspace resides

Let’s begin.

Enabling Microsoft Sentinel using the Bicep language

In this section, we will enable Microsoft Sentinel in your environment using infrastructure as code with Azure Bicep. Azure Bicep is a Domain-Specific Language (DSL) that uses a declarative syntax to deploy Azure resources.

Think of Bicep as an abstraction on...

Mitigating lateral movements

We can use Microsoft Defender for Identity, which includes a mechanism to detect lateral movements, and a powerful alternate method to remediate lateral movements is by configuring Fusion in Microsoft Sentinel, a correlation engine to detect multistage attacks automatically.

Fusion is a powerful engine integrated with Microsoft Sentinel that identifies combinations of anomalous behaviors and malicious activities observed at different kill chain stages.

Microsoft Sentinel can generate incidents with multiple alerts or activities, and Fusion will correlate all signals from various products and detect advanced attacks. Fusion detections will be shown as Fusion incidents on the Microsoft Sentinel Incidents page. Fusion incidents are stored in the SecurityIncident table in Logs.

How can we enable Fusion? It is enabled as an analytics rule and can help us cover a variety of scenarios, such as the following:

• Compute resource abuse
• Credential...

Summary

In this chapter, we reviewed how organizations can benefit from adopting the Zero Trust model and protect their assets by providing the right tools for their security analysts, such as Microsoft Sentinel. We also reviewed different methods to enable Microsoft Sentinel in your environment, and we saw how you can work with the Microsoft 365 Defender connector and leverage Fusion to mitigate lateral movement in your organization.

In the next chapter, we will discuss the various Azure data solutions offered by Microsoft that are designed to help organizations manage and analyze their data more effectively. The solutions are flexible and scalable and can be used to process and store data of various types and sizes, from structured to unstructured, from batch to real time, and from small to very large.