Lateral Movement Concepts

# RoE: authorised testing only. Lab use only. Every offensive note pairs with detection + hardening.

# ===== Why study =====
# After initial compromise, attackers move sideways to expand access — file shares,
# domain controllers, cloud consoles. Defenders need to know the vectors to detect
# and contain them.

# ===== Common vectors (with defenses) =====

# 1. Pass-the-Hash (Windows)
# Reuse NTLM hashes without cracking the password.
# Defense:
# - Disable NTLM where possible (NTLMv2 minimum)
# - Credential Guard
# - LAPS for local admin password rotation
# - Tier 0/1/2 separation; admins never log into low-tier hosts

# 2. Pass-the-Ticket (Kerberos)
# Steal a Kerberos ticket and reuse it.
# Defense:
# - Short ticket lifetimes (default 10h is long; tune down)
# - Disable DES / RC4; require AES
# - Protected Users group
# - Detection: Event ID 4768/4769 anomalies

# 3. Golden / Silver tickets
# Forge tickets with the krbtgt account secret (golden) or a service account (silver).
# Defense:
# - Rotate krbtgt password TWICE every 90-180 days
# - Monitor for tickets with unusual lifetime or RC4 etype
# - Tier-0 isolation; krbtgt never exposed

# 4. SMB lateral move
# net use / xcopy / wmic / psexec to move files + execute on remote hosts.
# Defense:
# - Network segmentation (block SMB between workstations)
# - Windows Firewall to deny inbound SMB by default
# - Detection: Sysmon Event 3 (network) + 1 (process) correlated

# 5. WMI / WinRM remote execution
# wmic /node:host process call create / Enter-PSSession
# Defense:
# - Restrict WMI / WinRM access (IPsec, firewall)
# - PowerShell Constrained Language Mode
# - Logging: Module + script-block + transcription

# 6. RDP hopping
# Attacker compromises one host, RDPs to another with the same creds.
# Defense:
# - Restricted Admin Mode for RDP (no credentials cached on target)
# - MFA on RDP via Duo / Azure MFA
# - Limit who can RDP via Network Level Authentication + GPOs

# 7. Cloud lateral (AWS / GCP / Azure)
# Compromised EC2 instance metadata -> IAM role -> wider access.
# Defense:
# - IMDSv2 (token-based) instead of IMDSv1
# - Tight IAM roles (least privilege)
# - GuardDuty for anomaly detection
# - Network egress allowlists block C2

# 8. Kubernetes lateral
# Compromised pod -> service account token -> API server.
# Defense:
# - Disable automount on default SA
# - Tight RBAC scoped to namespace
# - Network policies between namespaces
# - Pod Security Admission (restricted by default)

# ===== Detection patterns (SIEM rules) =====
# - Service creation on multiple hosts in short window
# - Same credential used across many hosts in minutes
# - WinRM / WMI calls from non-admin workstations
# - Kerberos AS-REP without pre-authentication (ASREP-roasting)
# - krbtgt password use in unexpected context
# - IAM role being assumed from unusual region / IP
# - Cloud API calls from EC2 with new permissions enumeration

# ===== Defensive baseline =====
# - Zero Trust networking (no flat networks)
# - Microsegmentation (VLANs, NACLs, NSGs, network policies)
# - Identity tiering (Tier 0/1/2 in AD)
# - Privileged Access Workstations (PAWs)
# - Just-in-time admin (CyberArk, Delinea, Azure PIM)
# - EDR + SIEM with detection rules per vector
# - Honey accounts / honey shares as canaries

# ===== Tools (defensive lab use) =====
# - BloodHound: map AD attack paths -> remove them
# - PingCastle: AD health audit
# - PurpleKnight: AD security checks
# - Atomic Red Team: validate detections per ATT&CK technique
# - Caldera: automated adversary emulation

# ===== Patterns to internalise =====
# - RoE FIRST; lab only
# - Every lateral vector pairs with a detection + segmentation control
# - Tier 0/1/2 separation in AD; never reuse credentials across tiers
# - Microsegmentation everywhere; deny by default
# - Audit AD attack paths (BloodHound) quarterly

# ===== Pitfalls =====
# - Testing on production
# - Trusting NTLM / RC4 in 2026
# - Wide IAM in cloud (AdministratorAccess + Everyone groups)
# - Flat networks where east-west is unrestricted
# - Skipping the hardening write-up

# Lateral movement concepts to understand:
#   - SMB / WMI / WinRM
#   - Pass-the-hash, Kerberoasting (AD)
#   - SSH agent forwarding misuse
# Defence-focused mitigations: tiered admin, just-in-time, credential guard.