Lateral Movement — Network Signatures and Detection

After initial access, attackers move laterally to reach high-value targets — domain controllers, file servers, data repositories. This movement leaves network artifacts: connections that wouldn’t exist under normal operation, from sources that don’t normally connect to those destinations.

The Lateral Movement Network Footprint

Lateral movement typically involves:

1. Discovery — scanning to identify live hosts and services (T1046)
2. Credential use — authenticating via RDP, SMB, WinRM, SSH using captured credentials
3. Tool transfer — copying attacker tools or malware to the new target

Each phase has a distinct network signature.

Discovery: Port and Network Scanning

What scanning looks like in conn.log:

# Port scan: one host, many ports, many S0/REJ states, tiny duration
ts          src_ip      dst_ip       dst_port  conn_state  duration  orig_bytes
14:30:00    10.1.2.3    10.1.2.50    22        S0          0.001     0
14:30:00    10.1.2.3    10.1.2.50    23        REJ         0.001     0
14:30:00    10.1.2.3    10.1.2.50    25        S0          0.001     0
14:30:00    10.1.2.3    10.1.2.50    80        REJ         0.001     0
... (thousands of entries in seconds)

Host discovery: many hosts, few ports:

ts          src_ip      dst_ip       dst_port  conn_state
14:31:00    10.1.2.3    10.1.2.1     445       REJ
14:31:00    10.1.2.3    10.1.2.2     445       S0
14:31:00    10.1.2.3    10.1.2.4     445       REJ
...
14:31:02    10.1.2.3    10.1.2.254   445       SF   ← alive host found

KQL for scan detection:

Zeek_conn_CL
| where TimeGenerated > ago(1h)
| where conn_state_s in ("S0", "REJ")
| summarize 
    scan_count = count(),
    unique_dst_ports = dcount(id_resp_p_i),
    unique_dst_hosts = dcount(id_resp_h_s)
  by id_orig_h_s, bin(TimeGenerated, 5m)
| where scan_count > 100
| order by scan_count desc

RDP Lateral Movement (T1021.001)

RDP (port 3389) is one of the most common lateral movement protocols in Windows environments.

Legitimate RDP pattern:

• Admin connects from jump box (10.0.1.5) to server (10.0.2.100)
• Duration: 20-60 minutes (human working session)
• Small number of sessions per day
• Same source-destination pair used repeatedly

Lateral movement RDP pattern:

• Workstation-to-workstation or workstation-to-server (no jump box involved)
• Duration: 5-60 seconds (credential test or automated tool)
• Many unique destination IPs from one source
• First-seen connection between these hosts

KQL for suspicious RDP:

Zeek_conn_CL
| where id_resp_p_i == 3389
| where local_orig_b == true and local_resp_b == true  // internal-to-internal
| summarize 
    session_count = count(),
    unique_dst = dcount(id_resp_h_s),
    min_duration = min(duration_d),
    avg_duration = avg(duration_d)
  by id_orig_h_s, bin(TimeGenerated, 1h)
| where unique_dst > 5 or min_duration < 60  // scanning or short test sessions

SMB Lateral Movement (T1021.002)

SMB (port 445) is used for file shares, printer shares, and (critically) remote code execution via administrative shares.

Normal SMB:

• Workstation → file server (scheduled, during business hours)
• Domain controllers for authentication traffic
• IT admin → servers for patch management

Suspicious SMB:

• Workstation → workstation (peer-to-peer SMB is rare in most enterprises)
• Access to ADMIN$, C$, IPC$ (administrative shares — not normal users)
• Rapid SMB connections to many hosts (lateral spread)
• SMB followed immediately by a new service (PSExec pattern)

PSExec network signature:

PSExec connects via SMB, creates a service on the remote host, and executes a binary via that service:

1. SMB connection to 10.1.2.50:445  (service=smb)
2. Access ADMIN$ share
3. Copy PSEXESVC.exe to remote host (files.log entry)
4. IPC$ share access (service creation via IPC)
5. New service "PSEXESVC" runs binary → new connection from 10.1.2.50

Zeek files.log will show the binary transfer; conn.log will show the SMB session.

WinRM Lateral Movement (T1021.006)

WinRM (Windows Remote Management) uses port 5985 (HTTP) or 5986 (HTTPS) for remote PowerShell execution. Commonly used by attackers with tools like Evil-WinRM, Invoke-Command.

Network signature:

• Port 5985 or 5986, internal-to-internal
• HTTP traffic (http.log) showing SOAP-encoded commands
• Connections from workstations to servers that don’t normally receive WinRM

# WinRM PowerShell remoting in conn.log:
src=10.1.2.3, dst=10.1.2.50, dst_port=5985, service=http, duration=30s

The http.log will show POST requests to /wsman URI — this is the WinRM endpoint.