Investigating lateral movement attacks
As we learned earlier in this book, lateral movement refers to the techniques that an attacker employs, after gaining initial access to the system and discovering the victim network, to pivot from the compromised machine to another machine in the same network to search for sensitive data and valuable assets. Also, we mentioned that to move from one machine to another, the attacker must use a lateral movement technique such as remote desktop application, remote PowerShell command execution, or Windows admin shares.
In this section, we will discuss the following lateral movement techniques and how to investigate them by analyzing the firewall logs:
- Remote desktop application (RDP)
- Windows admin shares
- PowerShell Remoting
Remote desktop application (RDP)
An attacker can rely on Windows’ built-in remote desktop administration tool to gain complete access and control over remote systems within the compromised network...
