Huntress Details Its Approach to Detecting Lateral Movement
Summary
Huntress describes correlating remote authentication and process execution to detect lateral movement, with examples involving DCOM, RDP, credential dumping, and ransomware precursors. It also recommends least privilege, MFA, segmentation, and protocol hardening.
Key points
- Huntress says its EDR focuses on remote authentication and execution at the target machine, linking logon details to processes launched within that session.
- The approach covers activity involving DCOM, WinRM, RDP, and PowerShell Remoting, while aiming to reduce false positives from routine administration and remote-management tools.
- Huntress describes detecting malicious remote commands on an SQL server, followed by an attempt to enable RDP.
- In another case, it identified credential compromise, shadow-copy deletion, and sensitive-file staging across two hosts before ransomware execution.
- A separate example involved LSASS credential dumping through rundll32.exe, triggered via MMC and DCOM.
- The article recommends least privilege, MFA, network segmentation, restricting RDP, disabling NTLM where possible, and continuous behavioral monitoring.
Article Details
- Defense Focus
- Detect lateral movement by correlating remote authentication with process execution on the target machine, while reducing false positives and identifying activity across the attack chain.
- Detection Methods
- Correlate remote authentication events with the processes executed in the resulting logon session.
- Investigate unusual source IP addresses, logon types, and interactive logons, including remote access from public IP addresses.
- Hunt for remote execution over DCOM, WinRM, RDP, and SMB, and suspicious use of tools associated with those protocols.
- Monitor for LSASS credential-dumping attempts, reconnaissance, suspicious authentication patterns, and remote service abuse.
- Look for ransomware precursors such as security-tool or service termination, shadow-copy deletion, log clearing, and staging of sensitive files.
- Correlate activity across hosts and identities to identify suspicious sequences before ransomware execution.
- Data Sources
- Remote authentication events, including source IP address, source port, source hostname, logon type, and logon ID.
- Process execution events and process trees associated with authenticated logon sessions.
- Endpoint telemetry for LSASS access, registry changes, remote service activity, and shadow-copy or log deletion.
- Identity sign-in patterns, privilege use, and account activity.
- Rule Types
- Behavioral detections for suspicious remote authentication and process execution.
- Correlated authentication-and-execution detections.
- Behavioral detections for credential dumping, reconnaissance, remote service abuse, and ransomware precursors.
- Platforms
- Endpoint detection and response (EDR)
- Identity threat detection and response (ITDR)
- Defensive Actions
- Apply least privilege and multi-factor authentication, especially to privileged accounts.
- Segment networks to limit movement between systems.
- Disable NTLM where possible, restrict RDP access to necessary machines and users, and remove default administrative shares.
- Continuously monitor authentication and endpoint activity, correlating logons with subsequent process execution.
- Investigate and respond to suspicious cross-host activity and ransomware precursor behaviors before payload execution.
MITRE ATT&CK
T1003.001 · LSASS MemoryThe article describes dumping credentials from LSASS, including an observed rundll32.exe loading comsvcs.dll.T1003.003 · NTDSAn observed sequence included dumping ntds.dit to a staging directory.T1021.001 · Remote Desktop ProtocolRDP is described as a lateral-movement transport, including an observed attempt to enable RDP on an affected server.T1021.002 · SMB/Windows Admin SharesSMB is identified as a common protocol used for lateral movement.T1021.003 · Distributed Component Object ModelThe article describes lateral movement through DCOM, including MMC COM object activation and WMI execution over DCOM.T1021.006 · Windows Remote ManagementWinRM is identified as a transport for remote execution and lateral movement.T1059.001 · PowerShellThe example scenario uses an encoded PowerShell command executed remotely through an MMC20.Application COM object.T1078 · Valid AccountsThe article describes lateral movement using valid credentials to authenticate to remote machines.T1110 · Brute ForceBrute-forcing attempts were logged on Host A before a user logged in from a suspicious IP address and hostname.T1112 · Modify RegistryA threat actor was observed trying to enable RDP connections via the registry.T1490 · Inhibit System RecoveryThe article describes deleting shadow copies as a suspicious activity and ransomware precursor.T1550.002 · Pass the HashThe article explains pass-the-hash authentication using a stolen NTLM password hash to access remote systems.
People
Vendors
Products
Entra IDHuntress Managed ITDR monitors identity behavior across your Microsoft 365, Entra ID, and Google Workspace identities tracking sign-in patterns, privilege use, and account activity in real time. When an account thatGoogle WorkspaceHuntress Managed ITDR monitors identity behavior across your Microsoft 365, Entra ID, and Google Workspace identities tracking sign-in patterns, privilege use, and account activity in real time. When an account thatHuntress Managed EDRHuntress Managed EDR monitors for lateral movement behaviors at multiple stages of the attack chain—credential theft attempts against Local Security Authority Subsystem Service (LSASS), reconnaissance activity,Huntress Managed ITDRHuntress Managed ITDR monitors identity behavior across your Microsoft 365, Entra ID, and Google Workspace identities tracking sign-in patterns, privilege use, and account activity in real time. When an account thatMicrosoft 365 Apps for EnterpriseHuntress Managed ITDR monitors identity behavior across your Microsoft 365, Entra ID, and Google Workspace identities tracking sign-in patterns, privilege use, and account activity in real time. When an account that