# Revisiting the Detection of Lateral Movement through Sysmon
## 2 Related Work  
The current section provides a brief review of the key pertinent literature on the subject. The concentration is on the methodology of each relevant work regarding event-driven identification of the most impactful LM techniques through Sysmon. Particularly, we focus on the logs collection of the specified examined attacks, the utilized rule-based policy, and the impact upon the successful incidence response. To facilitate the parsing of the relevant literature, Table 1 recaps the relevant characteristics of every work included in this section. JPCERT/CC, the first Computer Security Incident Response Team (CSIRT) established in Japan, was also one of the first organizations to conduct a full-fledged survey regarding the categories of logs produced during the execution of LM [3]. The commonest LM techniques at that time were executed against both compromised servers and targeted clients related to each attack method. Logging information was collected and categorized via Sysmon [4] and the MS Windows audit policy. The work concluded with the proposition of a log-oriented MS Windows regulatory policy, allowing the optimal collection of useful information related to potential LM methods. The final report was published in June 2017 and updated on v2 [5] in December of the same year. On the downside, considering the exponential occurrence of LM events and the daily lessons learned from the Russo-Ukrainian war, this survey is considered quite outdated to cope with MITRE's [1] database of malicious LM tactics and techniques on real-life observations. For instance,the aforementioned work can be extended to incorporate LM events in cloud and satellite communication facilities, such as the incident of February 2022 against Viasat's KA-SAT network [6], resulting in a targeted interruption of the satellite broadband services across the Ukraine territory and other European countries. [PERSON] et al. [7] introduced a data-driven threat classification methodology, which relies on the continuous analysis and assessment of aggregated Sysmon logs. The first part of this work was dedicated to the development of their proposed Cyber Threat Intelligence Ontology (CTIO), which was based on the Cyber Threat Intelligence (CTI) model also published by them in [8]. The second part of that paper proposed a threat assessment system that incorporated CTIO for the classification of event-logs generated by Sysmon in four distinct threat categories, namely high, medium, low, and unknown. Despite the promising results, the proposed threat assessment methodology is prone to long delays when it comes to voluminous logging data on real-life scenarios. [PERSON] et al. [9] presented a threat hunting model based on the common acceptance of the conclusion that the attacker and defender should mutually understand each other. The analysis was performed from both an offensive and defensive perspective. Offensive experiments were conducted upon the _APT29_ dataset, which is included in the Mordor Project of pre-recorded event-related logs of malicious activities. The two-staged attack emulation scenario initially incorporated the exfiltration of sensitive data for the targeted host and, then, the compromise of the target via an injected toolkit. The network activity of the targeted host was monitored with Sysmon to produce a dataset comprising two days of log recording. The finally proposed \"Indicators of Compromise\" enhanced the defender's common knowledge of the offender's best practices, seemingly improving the preventive identification of threats. Nevertheless, it seems that the proposed model is incapable of dealing effectively with the vast existence of false-positives due to the lack of Sysmon's rule-based configuration policy. The work in [10] proposed a Dynamic Link Library (DLL)-oriented method for malicious file detection towards logs collected by Sysmon.