Explore techniques for detecting lateral movement in network security through this 46-minute conference talk from Derbycon 7. Learn about various types of lateral movement, compromise scenarios, reconnaissance methods, and credential theft. Discover the challenges of automating detection and gain insights into useful datasets for identifying lateral movement. Examine stack counting techniques and find evidence of psexec access on victim systems.
Overview
Syllabus
Intro
Different Types of Lateral Movement
Compromise - Meterpreter Session
Compromise - discovering privileges
Compromise-confirming elevated privileges
Reconnaissance -User accounts
Reconnaissance - Network
Reconnaissance - Processes
Credential Theft
Automation of detection is hard
Datasets suggested for detection of lateral movement
Stack counting
Proof of psexec access on the victim system
