---
name: detect-lateral-movement
description: "Detection and hunt methodology for Windows lateral movement: remote execution over SMB/WMI/WinRM/RDP/DCOM (MITRE ATT&CK T1021, T1047, T1569.002), Pass-the-Hash and overpass-the-hash (T1550.002), lateral tool transfer (T1570), and internal tunneling or proxying (T1572, T1090.001). Names the Windows Security events (4624, 4648, 4672, 5140/5145, 7045/4697), Sysmon events, and WMI/WinRM/RDP operational logs that carry the signal, gives a hypothesis-driven hunt, and maps hardening to the Essential Eight, ISO 27001, and NIST CSF 2.0. Use when triaging an intrusion spreading host to host, hunting for PsExec/wmiexec/WinRM/DCOM remote exec, investigating NTLM network logons that look like Pass-the-Hash, chasing an internal tunnel or port-proxy, triaging 4624/4648/7045 alerts, or hardening admin paths against credential reuse."
---

# Lateral Movement - Defensive Methodology

> **Tier 2 - methodology skill.** No bespoke UMBRASEC detection rule ships with this skill yet. It gives the defender's method, the log sources and signals, the hunt, and the hardening, and points to public rule sources. Promotion to Tier 1 (a sourced, tuned UMBRASEC rule) is tracked in [COVERAGE.md](https://github.com/umbrasec-labs/umbra-blue/blob/main/COVERAGE.md). Do not treat the content below as citing a UMBRASEC rule; there is none for this threat yet.

## TL;DR

Lateral movement is one identity reused from one host to reach another. After an initial foothold an operator authenticates outward, runs code on the next box, and sometimes tunnels the hop so it skips your network sensors. You catch it at three choke points: the **authentication** (Security Event 4624 network logons and 4648 explicit-credential logons, especially NTLM logon type 3 from a workstation to a server, the classic Pass-the-Hash shape), the **remote execution** it enables (service installs in Event 7045, named pipes like `\\.\pipe\PSEXESVC` in Sysmon 17/18, `wmiprvse.exe` and `wsmprovhost.exe` spawning children), and the **channel** (Sysmon Event 3 and firewall logs showing long-lived connections, non-standard ports, `netsh portproxy`, or tunnel clients). None of these is alone conclusive; the signal is one account touching many hosts admin-to-admin in a short window. Use public, maintained rules (SigmaHQ, Defender for Identity) rather than a hand-rolled one, and layer authentication, execution and network telemetry so an attacker who evades one plane still trips another.

## What it looks like, defender view

In telemetry lateral movement shows up as a short burst of administrative authentication and remote execution fanning out from one source. A single account logs on to several hosts it does not normally touch, over the network (logon type 3) or over RDP (logon type 10), often with local-admin rights and often using NTLM where your domain would otherwise use Kerberos. On the destination a service appears, a named pipe opens, or a provider process (`wmiprvse.exe`, `wsmprovhost.exe`, `mmc.exe`, `dllhost.exe`) spawns `cmd.exe`, `powershell.exe` or a dropped binary. When the operator tunnels, the host-to-host hop disappears from network sensors and reappears as a single long-lived outbound connection, a local port-proxy, or a tunnel-client process. Pass-the-Hash specifically presents as a network logon that succeeds with NTLM and no preceding interactive logon that would explain where the credential material came from.

## Log sources and signals

Everything here assumes you ship Windows **Security** logs, **Sysmon**, and the relevant **operational** channels from workstations and servers, not only domain controllers. Lateral movement happens member-to-member, so DC-only logging is a blind spot.

- **Security 4624 (logon).** Watch `LogonType` 3 (network) and 10 (RemoteInteractive/RDP). For Pass-the-Hash the tell is `AuthenticationPackageName = NTLM` with `LogonProcessName = NtLmSsp` on a type-3 logon to a domain-joined server, where Kerberos would normally be used; correlate `IpAddress`, `TargetUserName`, and the destination host. Overpass-the-hash instead uses the NT hash to request a legitimate Kerberos TGT, so it shows as Kerberos on 4624; hunt it on the DC as a 4768 TGT request with RC4 encryption (`0x17`) for an account that should be AES, not on the NTLM marker here.
- **Security 4648 (explicit credentials).** "A logon was attempted using explicit credentials" fires for `runas`, PsExec `-u`, and many remote-exec tools. Fields `SubjectUserName`, `TargetUserName`, and `TargetServerName`/`TargetInfo` reveal account A on host X authenticating as account B to host Y.
- **Security 4672 and 4776.** 4672 (special privileges assigned) flags that the new session is administrative. 4776 (NTLM credential validation) on the authenticating server adds NTLM context.
- **Security 5140 / 5145 (file share and detailed share access).** Access to `ADMIN$`, `C$`, and `IPC$` is how SMB remote-exec (PsExec-class, `wmiexec`, `smbexec`) stages and runs. `ShareName` and `RelativeTargetName` carry the detail.
- **System 7045 and Security 4697 (service install).** Remote-exec tools register a service on the target to launch the payload. `ServiceName` and `ImagePath` are the signal; random or single-character service names and image paths in `ADMIN$`/temp are suspicious.
- **Sysmon Event 1 (process create).** `psexec`, `paexec`, `wmic process call create`, `winrs`, and provider processes spawning shells. Lean on `ParentImage`, `Image`, `CommandLine`, and `User`.
- **Sysmon Event 3 (network connection) and Event 22 (DNS).** Outbound to non-standard ports, long-lived flows, and resolutions to tunnel/relay domains.
- **Sysmon Event 17 / 18 (named pipe created/connected).** Pipes such as `\\.\pipe\PSEXESVC`, `\\.\pipe\paexec`, `\\.\pipe\remcom_*`, and `\\.\pipe\atsvc` are strong remote-exec indicators.
- **WMI: Microsoft-Windows-WMI-Activity/Operational (Event 5857/5860/5861).** Plus `wmiprvse.exe` as the parent of a shell (T1047).
- **WinRM: Microsoft-Windows-WinRM/Operational** and the `wsmprovhost.exe` process (T1021.006).
- **RDP: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational Event 1149**, LocalSessionManager Events 21/22/25, and Security 4778/4779 (T1021.001).
- **Network: firewall/NetFlow, and Zeek `conn.log`/`ssl.log`** for tunneling (T1572) and internal proxy (T1090.001). JA3/JA3S hashes, SNI, connection duration and byte-ratio are the fields that separate a tunnel from normal traffic. For host-based port-proxy, audit the registry key `HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp` and `netsh interface portproxy` command lines.

What normal looks like: service accounts and management tooling (SCCM/MECM, monitoring, backup, your RMM) do legitimate network logons and remote exec constantly. Baseline which accounts fan out to many hosts by design before you alert on fan-out.

## Detection approach

Alert on the convergence, not on any single event, because each event above also fires in benign administration. The high-value correlations:

- **Pass-the-Hash shape.** A type-3 NTLM logon (4624, `AuthenticationPackageName = NTLM`) to a server, by a domain user, with no corresponding interactive/Kerberos logon that explains the credential, especially where the source is a workstation and the target grants admin (4672). Microsoft **Defender for Identity** raises this natively as "Suspected identity theft (pass-the-hash)" and "Suspected overpass-the-hash", which is worth preferring to a raw log rule because MDI correlates across the domain.
- **Remote-exec fan-out.** One source account producing 4648/5140/7045 or the PSEXESVC/paexec/remcom named pipes across several distinct destinations in a short window.
- **Provider-process child shells.** `wmiprvse.exe`, `wsmprovhost.exe`, `services.exe` (for a freshly installed service), `mmc.exe` or `dllhost.exe` (DCOM, T1021.003) spawning `cmd.exe`/`powershell.exe`.
- **Tunnel and proxy.** Tunnel-client process names, `netsh ... portproxy` creation, and network flows that are long-lived, high-entropy, or to uncategorised destinations on non-standard ports.

Use public, maintained rules rather than inventing one. The [SigmaHQ repository](https://github.com/SigmaHQ/sigma) carries community rules for exactly these signals, notably under `rules/windows/builtin/security/` (4624/4648/4672 logon analytics, Pass-the-Hash), `rules/windows/pipe_created/` (PSEXESVC and related service pipes), `rules/windows/wmi_event/` and `rules/windows/process_creation/` (PsExec, `wmic process call create`, WinRM, DCOM), and `rules/windows/builtin/system/` (service install 7045). Microsoft documents the [Defender for Identity lateral-movement and credential-theft alerts](https://learn.microsoft.com/en-us/defender-for-identity/alerts-overview), and the [MITRE D3FEND](https://d3fend.mitre.org/) knowledge base maps the countermeasures listed below. A tuned UMBRASEC rule is not yet shipped for this threat.

## Threat hunt

Hypothesis: an operator who already holds valid credentials is reusing them to move host to host and has stayed under per-event alert thresholds.

1. Over a 7 to 30 day window, pull all 4624 type-3 and type-10 logons and build a per-(source host, account) count of **distinct destination hosts**. Rank by distinct-destination count. Human accounts that suddenly touch many servers are the lead; known management accounts are your allowlist baseline.
2. For each lead account, filter 4624 to `AuthenticationPackageName = NTLM` on type-3 logons to domain-joined targets. NTLM where Kerberos should apply is the Pass-the-Hash marker. Pivot to 4776 on the domain controller (or on the target only when the account is a local account) to confirm.
3. Join to execution: for the same source/account/time, look for 7045 service installs with random or temp-path `ImagePath`, 5145 access to `ADMIN$`/`IPC$`, and Sysmon 17/18 service pipes on the destinations.
4. Pivot to the network plane: for any destination reached, check Sysmon Event 3 and firewall logs for an outbound long-lived flow, a new `PortProxy` registry entry, or a tunnel-client process that would let the operator skip future authentication logging.
5. Rank by blast radius: a reused credential that reaches a domain controller, a backup server, or a hypervisor outweighs volume anywhere else.

## Hardening

Shrink the paths a reused credential can travel and the privilege it inherits on arrival. The mappings below follow the control codes used in the UMBRASEC [identity and access guide](https://umbrasec.dev/guide/identity-and-access.html) and [detection and response guide](https://umbrasec.dev/guide/detection-and-response.html); a cell is left blank where no single control maps cleanly. Network segmentation (restricting SMB/RDP/WinRM between workstations and to servers), disabling NTLM where Kerberos suffices, and local-admin password randomisation (LAPS) are the most direct lateral-movement controls but do not map cleanly to a single framework cell, so they are noted here in prose rather than forced into the table.

| Control | What it does | Essential Eight | ISO 27001:2022 | NIST CSF 2.0 |
|---|---|---|---|---|
| Tier admin access and remove standing local admin | A reused credential inherits far less, and admin tiering stops a workstation hash from opening a server | Restrict administrative privileges (ML2+) | A.8.2 Privileged access rights | PR.AA-05 Least privilege |
| Phishing-resistant MFA on privileged and remote access | Raises the cost of the initial credential and guards the admin accounts an operator wants to reuse | Multi-factor authentication (ML2+) | A.8.5 Secure authentication | PR.AA-03 Users authenticated |
| Turn on and ship logging from members, not only DCs | Without member logon, service and pipe telemetry none of the detections above exist | ML2/ML3 event-log requirements | A.8.15 Logging | DE.CM Continuous monitoring |
| EDR on every host | Catches the remote-exec and tunnel behaviour the raw logs can miss | (Beyond E8 - detection gap) | A.8.7 Malware; A.8.16 Monitoring | DE.CM; DE.AE Adverse events |
| Conditional access on where admin creds may authenticate | Limits which sources and contexts a privileged credential works from | Supports MFA and admin restriction at ML2/3 | A.5.15 Access control | PR.AA-03; PR.AA-05 |

## Honest limitations

A low-and-slow operator who reuses one credential to reach one high-value host, over a channel your environment already uses for administration (RDP, WinRM, an approved RMM), will not stand out in a fan-out count and may not trip any single-event rule. Pure Kerberos abuse (pass-the-ticket, overpass-the-hash that requests Kerberos) will not show the NTLM marker. If the operator tunnels before you have network sensors on internal east-west traffic, the hop is invisible on the wire and you are left with host telemetry only. And every signal here is dual-use: your own administrators, SCCM, monitoring, backup and RMM tooling do all of it legitimately, so the detections are only as good as the baseline you build first. Run any rule in report-only mode, allowlist your known management accounts and hosts, and treat the output as a lead to investigate, not a verdict.

## ATT&CK and D3FEND

- MITRE ATT&CK: [T1021 Remote Services](https://attack.mitre.org/techniques/T1021/) (and sub-techniques [.001 RDP](https://attack.mitre.org/techniques/T1021/001/), [.002 SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002/), [.003 DCOM](https://attack.mitre.org/techniques/T1021/003/), [.006 WinRM](https://attack.mitre.org/techniques/T1021/006/)); [T1047 Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047/); [T1569.002 System Services: Service Execution](https://attack.mitre.org/techniques/T1569/002/); [T1550.002 Use Alternate Authentication Material: Pass the Hash](https://attack.mitre.org/techniques/T1550/002/); [T1570 Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570/); [T1572 Protocol Tunneling](https://attack.mitre.org/techniques/T1572/); [T1090.001 Internal Proxy](https://attack.mitre.org/techniques/T1090/001/).
- MITRE D3FEND: [Network Traffic Analysis (D3-NTA)](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/), [Remote Terminal Session Detection (D3-RTSD)](https://d3fend.mitre.org/technique/d3f:RemoteTerminalSessionDetection/), [User Behavior Analysis (D3-UBA)](https://d3fend.mitre.org/technique/d3f:UserBehaviorAnalysis/), and [Multi-factor Authentication (D3-MFA)](https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/) for the privileged and remote-access paths in the hardening table (MFA raises the cost of capturing a credential; it does not by itself stop a stolen NT hash being replayed on an NTLM network logon).
- Public rule sources: [SigmaHQ](https://github.com/SigmaHQ/sigma) (Windows security, pipe_created, wmi_event, process_creation, and system rule directories); [Microsoft Defender for Identity alerts](https://learn.microsoft.com/en-us/defender-for-identity/alerts-overview).

**Scope note.** This is a defensive skill. It explains lateral movement only to the depth needed to detect and mitigate it, names no attack commands beyond the artifacts they leave, and ships no remote-exec, Pass-the-Hash, or tunneling tooling. UMBRASEC publishes defense, not offense.