# Revisiting the Detection of Lateral Movement through Sysmon
## 1 Introduction  
Lateral Movement (LM) refers to a wider set of techniques that adversaries use to gain initial access through a network's vulnerable endpoint for the lateral escalation of their presence in search of sensitive data and other valuable assets to compromise or exfiltrate. Simply put, after an attacker has acquired an initial foothold in a network and performed an internal reconnaissance, they will most probably seek to expand and reinforce that foothold while systematically gaining further access to important data or systems. For effectively dealing with such incidents in a prompt and effective manner, e.g., avoiding the overabundance of security alerts and false positives, a targeted and fresh approach is a necessity. Once the threat is remediated, and the log evidence related to the attack is collected, the impact calculation of the damage will be used as the basis for the constitution of remedial measures toward an effective Endpoint Detect and Response (EDR) policy. While the configuration of a network targeted by an adversary varies depending on its structure, there are some common patterns regarding LM methods. At first, typically, the attacker concentrates on the identification and enumeration of the targeted system, in parallel with the exfiltration of crucial information with tools such as Mimikatz, ipconfig, systeminfo, and others. The initial target is chosen with mediation, as this will be the first step for the rest of the LM to be expanded. Credential dumping follows; this will permit the perpetrator to acquire the necessary credential information, leveraging tools such as Mimikatz, pwdump, LazagneProject, or even malware in an effort to infect the targeted host and acquire administrative access. Common techniques presented in MITRE's records [1] reveal that in such conventional similar assault cases, the adversaries repeatedly leveragea limited number of penetration tools. Therefore, the key points that this paper aims to address are narrowed down to the fundamental and technical particles of each attack, specifically related to the so-called \"5 Ws\" analysis, namely Who-What-When-Where-Why. Precisely, the work at hand relies on the execution of the most frequently encountered LM techniques based on their impact, as presented on MITRE's ATT and CK database of adversaries, tactics and techniques [1]. Particularly, we exploit a properly designed testbed via nine diverse LM techniques, namely \"Exploitation of Remote Services (ERS)\" (four variants of ERS attack), \"Pass the Hash (PtH)\", \"Pass the Ticket (PtT)\", \"Golden Ticket (GT)\", \"Silver Ticket (ST)\" and \"Post Exploitation on Stored Passwords with (LZP)\". Our aim is to provide concrete answers to the following key questions: (a) Based on related theory and domain expertise's best practices, are there any solid criteria for determining the most effective, upon LM identification, rule-based features of the system monitoring tool (Sysmon)?, and (b) how could the proposed criteria combined with the extracted features lead to the formation of a top-notch rule-based and event-driven methodology, which generalizes the identification of any LM attack? Overall, the main contributions of this work vis-a-vis the relevant literature are summarized as follows:  
* From a defender's viewpoint, we elaborate on the outcomes of the executed experiments in an attempt to define solid criteria, which act as signatures per examined attack. * Based on the derived criteria, the most impactful features were extracted as related to Sysmon's identification of an adversary moving laterally. * The proposed criteria, along with their related features, are evaluated based on their effectiveness on a potential lateral incident's identification through Sysmon. * A rule-based methodology is proposed that is dedicated to the identification, verification, and categorization of each lateral technique. * The proposed methodology is implemented in a Python analyzing tool dubbed \"PeX\".