One compromised host is a problem; a compromised network is a crisis. Lateral movement is how attackers turn the first into the second - and it leaves distinctive tracks.
Common techniques
- PsExec-style - copy a payload to the ADMIN$ share, then create/start a service to run it remotely. Watch for Event ID 7045 (new service) + admin-share writes.
- WMI / WinRM - remote execution via
wmicor PowerShell remoting. Watch WMI process creation and WinRM (5985/5986) connections. - RDP (Type 10 logon) - interactive remote sessions, sometimes tunneled.
- Pass-the-Hash / Pass-the-Ticket - reusing stolen credential material (Type 3 logons from odd sources).
The events that catch it
- 4624 logon types 3 (network) and 10 (RDP) from unusual source hosts/accounts.
- 7045 - new, oddly-named services appearing across hosts.
- Admin-share access (
\\host\ADMIN$,C$) followed by execution. - A service/helpdesk account authenticating to hosts it never touches.
The mindset
Lateral movement is about relationships: which account, touching which host, over which protocol, and is that normal? Baseline the graph of who-talks-to-whom, and the attacker's new edges light up. Tools like BloodHound show the paths; your logs show them being walked.