Detecting Lateral Movement with Splunk: How To Spot the Signs | Splunk

Once badness makes an inroad into your network, the adversary has a set of goals — steal credentials, persist, find the good stuff, exfiltrate the good stuff, and get paid! To do that, they need to move laterally. We have touched on two ways in which an adversary can traverse the network and we did this with only three sources of data — Windows Security, System events, and Sysmon. Other data sources like network metadata and registry entries can also be used for spotting lateral movement. (Part of our Threat Hunting with Splunk series, this article was originally written by Derek King. We’ve updated it recently to maximize your value.) Lateral movement is one of the key indicators for any time when you actually have an Advanced Persistent Threat (APT) in your network. Finding this lateral movement can be difficult because adversaries often use legitimate credentials to move around your network. Lateral movement happens in two ways: In this post, we’ll focus on using legitimate tools fo

Detecting Lateral Movement with Splunk: How To Spot the Signs | Splunk Detecting Lateral Movement with Splunk: How To Spot the Signs Security April 02, 2024 Madeleine Tauber , Tamara Chacon Once badness makes an inroad into your network, the adversary has a set of goals — steal credentials, persist, find the good stuff, exfiltrate the good stuff, and get paid! To do that, they need to move laterally. We have touched on two ways in which an adversary can traverse the network and we did this with only three sources of data — Windows Security, System events, and Sysmon. Other data sources like ne

related reading

• Cloud coverage: Detecting an email payroll diversion attackredcanary.com
• What Is Cyber Threat Hunting? Complete Guide | Exabeamexabeam.com
• Baseline Hunting with the PEAK Framework | Splunksplunk.com
• A guide to threat hunting and monitoring in Snowflake | Datadog Security Labssecuritylabs.datadoghq.com
• Introducing the PEAK Threat Hunting Framework | Splunksplunk.com
• PerfectData Software Abuse and Account Takeover Risksdarktrace.com
• Shifting detection left for more effective threat detectionpushsecurity.com
• Common Oauth Apps Used in Business Email Compromise - Syne's Cyber Cornercybercorner.tech
• Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework | Splunksplunk.com
• Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learnlearn.microsoft.com
• Email Compromise To Mass Phishing Campaigndarktrace.com
• Lessons learned from EDR Bypass threat hunting | by Cristóbal Martínez | Mediummedium.com