Detecting lateral movement
Since network propagation is the connecting element between the hosts involved in an incident, it makes sense to consider the search for traces of their execution from two perspectives – the source position and the destination position. In this case, the main sources of traces of lateral movement that we will consider will be the already-known-to-us event logs, the system files, the registry, and the filesystem. Well, less discussion; let’s start with searching for traces of using remote services.
Remote services
When using remote services to move around the network, adversaries may use extracted valid accounts to connect to remote hosts via RDP, WinRM, and remote access tools such as PsExec. In this case, both the source and destination hosts will have some traces left behind.
Thus, when connecting via RDP, the source host will log event IDs 1024 and 1102 in the Microsoft-Windows-Terminal Services-RDPClient/Operational event log located...
