Lion Cipher Lab
Understand and detect lateral movement
- Digital Forensics & IR (DFIR)
- Intermediate
- ~55 min
- Free · no account required
Why it matters
Almost no serious intrusion stays on the first machine. An attacker lands somewhere ordinary -- a phished laptop, an exposed service -- and the damage comes from what happens next: they walk sideways, host by host, hunting for the file server, the domain controller, the data. That sideways walk is lateral movement, and it is where a fast defender can still win, because the attacker has to keep authenticating and keep creating footholds, and each of those leaves a record. The catch that most tutorials skip is that those records look almost exactly like a busy administrator's normal Tuesday:…
What you'll learn
- understanding what lateral movement and east-west traffic are
- recognising the common lateral-movement techniques (remote services over RDP/SMB/WinRM/SSH, use of admin shares, pass-the-hash, remote service and scheduled-task creation)
- reading logon types on Event ID 4624 to tell a network or remote-desktop logon apart from someone at the keyboard
- spotting new source-to-destination logon pairs that break the normal internal pattern
- spotting remote service creation (Event ID 7045 / 4697) and writes to admin shares (C$, ADMIN$) as movement signals
- writing detection queries against your own auth logs with PowerShell Get-WinEvent
- baselining normal internal activity first, so a signal is treated as a lead to investigate rather than a verdict
Steps in this lab
- What lateral movement and east-west traffic are
- How they move, part 1: remote services and admin shares
- How they move, part 2: pass-the-hash and remote footholds
- Signal 1: unusual internal logons (Event ID 4624 and logon types)
- Signal 2: remote footholds and admin-share writes
- Baseline normal FIRST, then hunt
- Two detection queries to keep
- The honest catch: a signal is a lead, not a verdict