analyzing lateral movement and pivoting IOCs

lateral movement

technique to progressively move through a network to search for the key data and assets that are ultimately the target of an attack campagin

• identifying irregular P2P communication can identify lateral movement

• attackers can use remote access protocols to move from host to host

pivoting

the use of one infected computer to attack a different computer

• uses the compromised system to attack other systems on the same network to avoid restrictions such as firewall configurations

• attackers can chain proxy servers together in order to continue pivoting from host to host until they reach a mission critical host or server

pass the hash

network based attack where the attacker steals hashed user credentials and uses them as-is to try to authenticate to the same network the hashed credentials originated on

• it is possible to present the hash without cracking the original password to authenticate to network protocols such as SMB and Kerberos

• pass the hash can be used to elevate privileges because when it used on a local workstation, an attacker can gain local admin privileges

Mimikatz

open-source application that allows users to view and save authentication credentials in order to perform pass the hash attacks

• scans system memory for cached passwords processed by the local security authority subsystem service (lsass.exe)

• while a pass the hash attack will work on local workstations, a kerberos ticket is needed in an Active Directory environment

golden ticket

a kerberos ticket that can grant other tickets in an Active Directory environment

• can grant administrative access to other domain members and controllers

• allow attackers to laterally move across the entire domain with ease

krbtgt hash

the trust anchor of the Active Directory domain which functions like a private key of a root certiciate authority and generates ticket-granting tickets(TGT) that are used by the users to access services within Kerberos

remote access services

any combination of hardware and software to enable the remote access tools or information that typically reside on a network of IT devices

• SSH, Telnet, RDP, and VNC provide attackers the ability to laterally move across the network

windows management instrumentation command-line(WMIC)

provides users with a terminal interface and enables adminstrators to run scripts to manage those computers

• can be used as a vector in post-attack lateral movement

PsExec

a tool developed as an alternative to Telnet and other remote access services which utilizes the Windows SYSTEM account for privilege escalation

Windows PowerShell

a task automation and configuration management framework from microsoft, consisting of a command line shell and the associated scripting language

• PowerShell Empire toolkit contains numerous prebuilt attack modules

the difference between lateral movement and pivoting

if you have an attack point established and then you’re conducting your attacks from that point in the network, that is your pivot point

port forwarding

the attacker uses a host as pivot and is then able to access one of its open TCP/IP ports to send traffic from this port to a port of a host on a different subnet

• SSH can also be used to pivot to other hosts using the -D flag which sets up a local proxy and port forwarding