Lateral Movement Response

What This Playbook Covers

• This playbook handles confirmed lateral movement — when you have evidence that an attacker has moved from one host to another using remote administration tools. It does not cover the initial compromise or the final impact phase.
• Lateral movement is the most critical phase to interrupt. Before lateral movement, the breach is limited to a single host. After lateral movement, the attacker controls credentials, can reach sensitive servers, and may establish persistence.
• MITRE ATT&CK references: T1021 (Remote Services — RDP, SMB, SSH), T1570 (Lateral Tool Transfer), T1047 (Windows Management Instrumentation), T1059 (Command and Scripting Interpreter).
• Parallel playbooks: Privilege Escalation Investigation (often precedes lateral movement), Suspicious Authentication (credential abuse), Initial Access Response (find how the attacker got in).

Phase 1: Identify the Lateral Movement Method (0-15 minutes)

Each lateral movement technique produces a distinct detection signature. Identify the method first to determine the best containment strategy.

RDP Lateral Movement (T1021.001)

SPL query — RDP lateral movement detection:

index=windows sourcetype="WinEventLog:Security" EventCode=4624 LogonType=10
| stats count by SourceIp, Computer, Account_Name, bin(_time, 1h)
| where count > 2
| eval alert = "RDP lateral movement — " . Account_Name . " from " . SourceIp . " to " . Computer . " (" . count . " connections in 1h)"
| table _time, SourceIp, Computer, Account_Name, count, alert
| sort - count

WMI Lateral Movement (T1047)

SPL query — WMI lateral movement detection:

index=windows sourcetype="WinEventLog:Security" EventCode=4688
| search ParentProcessName="*WmiPrvSE.exe"
| where NewProcessName NOT IN ("C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "C:\\Windows\\System32\\svchost.exe")
| eval alert = "WMI process creation — " . NewProcessName . " spawned by WmiPrvSE.exe on " . Computer
| table _time, Computer, NewProcessName, CommandLine, alert

PsExec Lateral Movement (T1570, T1021.002)

SPL query — PsExec detection:

index=windows sourcetype="WinEventLog:System" EventCode=7045
| search ServiceName="PSEXESVC" OR ServiceName="psexec"
| eval alert = "CRITICAL — PsExec service installed on " . Computer
| table _time, Computer, ServiceName, ImagePath, alert

SMB Lateral Movement / Pass-the-Hash (T1021.002, T1550.002)

SSH Lateral Movement (Linux)

Phase 2: Containment (15-30 minutes)

Immediate Actions — Regardless of Movement Type

• Isolate the compromised host — disable network on the origin host (not just the destination)
• Block the lateral movement path — create firewall rules between subnets if segmentation is weak
• Disable the compromised user account — the attacker is using stolen credentials
• Revoke Kerberos tickets for the compromised user — klist purge or Invoke-KerberosTicketPurge

Technique-Specific Containment

Phase 3: Trace the Movement Path (30-60 minutes)

Step 1 — Build the Lateral Movement Chain

Identify every host the attacker touched:

Initial Compromise: HOST_A (10.0.1.5)
    ↓ RDP (LogonType 10) via user jdoe
HOST_B (10.0.2.10)
    ↓ WMI (WmiPrvSE.exe → powershell.exe)
HOST_C (10.0.2.20)
    ↓ PsExec (Service: PSEXESVC)
HOST_D — Domain Controller (10.0.100.5)

Step 2 — Collect Evidence Per Host

Phase 4: Detection Query Reference

Find All Lateral Movement in a Time Window

SPL — comprehensive lateral movement detection:

index=windows (sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:Sysmon" OR sourcetype="WinEventLog:System")
| eval movement_type = 
    if(EventCode=4624 AND LogonType=10, "RDP") .
    if(EventCode=4624 AND LogonType=3 AND SourceIp!="", "SMB/Network") .
    if(EventCode=4688 AND ParentProcessName="*WmiPrvSE*", "WMI") .
    if(EventCode=7045 AND ServiceName="PSEXESVC", "PsExec") .
    if(EventCode=5140 AND ShareName="ADMIN$", "ADMIN$ Share")
| where movement_type != ""
| eval alert = "LATERAL MOVEMENT: " . movement_type . " — " . " from " . coalesce(SourceIp, "local") . " on " . Computer
| table _time, Computer, SourceIp, Account_Name, movement_type, alert
| sort - _time

Network-Based Detection — Multiple Logons from Same Source

index=windows sourcetype="WinEventLog:Security" EventCode=4624
| stats dc(Computer) as unique_hosts, values(Computer) as hosts_accessed by SourceIp, Account_Name, bin(_time, 1h)
| where unique_hosts > 3
| eval alert = Account_Name . " accessed " . unique_hosts . " hosts from " . SourceIp . " in 1 hour — lateral movement pattern"
| table _time, SourceIp, Account_Name, unique_hosts, hosts_accessed, alert
| sort - unique_hosts

Phase 5: Recovery and Hardening

Related

• Common Ports and Protocols — covers the common ports and protocols concepts
• EDR Basics — detection and response for T1059, T1003, T1055, T1204, T1562 techniques
• Indicators: IoC, IoA, and TTP — covers the indicators: ioc, ioa, and ttp concepts
• Log Sources Overview — covers the log sources overview concepts
• MITRE ATT&CK for Triage — covers the mitre att&ck for triage concepts

Sources

• MITRE ATT&CK — T1021 (Remote Services)
• MITRE ATT&CK — T1570 (Lateral Tool Transfer)
• MITRE ATT&CK — T1047 (Windows Management Instrumentation)
• Microsoft — Lateral Movement Detection
• CIS — Network Segmentation Guide