Detecting Lateral Movements in Windows Infrastructure

Lateral movement techniques are widely used in sophisticated cyber-attacks in particular in Advanced Persistent Threats (APTs). The adversary uses these techniques to access other hosts from a compromised system and get access to sensitive resources, such as mailboxes, shared folders, or credentials. These can be used in turn for compromise of additional systems, privilege escalation, or stealing more valuable credentials. This type of attack may ultimately give access to the Domain Controller and provide full control of a Windows-based infrastructure or business-related operator accounts.
This white-paper provides guidelines to detect the lateral movements exploiting NTLM and Kerberos protocols in a Windows Vista / 7 and 2008 based environment. Windows 10 introduces many additional security mechanisms, and hence CERT-EU is planning to release a separate white-paper regarding lateral movement detection on Windows 10.