# Revisiting the Detection of Lateral Movement through Sysmon
## 3 Preliminaries on Lateral Movement  
This section comprises a descriptive presentation of the most prominent and fundamental techniques with which an adversary may move laterally and compromise computing systems and accounts in a Small Office Home Office (SOHO) or corporate networking environments. For an attacker to compromise a targeted host, initial access is gained \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline  & \multicolumn{2}{c}{**Related Work**} \\ \hline
**Title** & **Year** & **Summary** \\ \hline A novel approach for detecting malware based on API call sequence analysis [16] & 2015 & Detection of malware API call patterns towards the identification of behavioral anomaly signatures \\ \hline Detecting lateral movement through tracking event logs (v1 \& 2) [3; 5] & Execution of LM through well-known penetration testing tools. Collection of logs with Sysmon and MS Windows Audit Policy. Categorization of logs per attack and proposition of optimal MS Windows infiltration settings for effective identification of LM activity. \\ \hline Data-driven threat hunting using Sysmon [7] & 2018 & Data-driven threat classification methodology based on aggregated logs created by Sysmon.posed a threat analysis system, which is based on the developed by the authors CTI ontology. \\ \hline Lateral movement detection using ELR stack [14] & 2018 & A way to generate event logs with Sysmon related to the execution of various LM attacks and the associated malicious tools on MS Windows-based environments. Implementation of ELR stack towards the analysis of possible abnormalities in the collected logs due to the existence of LM. \\ \hline Real-time detection system against malicious tools by monitoring DLL on client computers [10] & 2019 & Proposed a DLL-oriented method for malicious file detection through logs collected by Sysmon [4]. Common DLL list per malicious tool, independent of MS Windows OS version. \\ \hline Detecting Mimikatz in lateral movements using Mutex [15] & 2020 & APT detection of Mimikatz while utilized in LM. Implementation of Mutex memory objects in conjunction with DLL files analysis. Mimikatz’s misidentification while deliberately obfuscated. \\ \hline From TTP to IoC: Advanced persistent graphs for threat hunting [9] & 2021 & Threat hunting model which evaluates Sysmon’s logs from both an offender’s and defender’s perspective. Based on indicators of compromise, proactive threat detection is possibly enhanced. A high rate of false positives due to the absence of rule-based Sysmon’s configuration. \\ \hline Hopper: Modeling and detecting lateral movement [17] & 2021 & System for LM attack detection based on real-life generated logs. Login activity is tracked and outlined through a graph of interrelated logins among the implicated hosts to conclude in the detection of anomalies among logins referring to LM. \\ \hline Network forensics investigation in virtual data centers using ELR [13] & 2021 & Generating log records with _Logstash_. Network forensic analysis via the implementation of Elastic Search and towards the identification of RDP LM-related attacks, Ransomware, Data Exfiltration, etc., as part of a criminal investigation. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of the most important aspects of the works included in Section 2. The works are presented in chronological ascending order. through the continuous and iterative enumeration of the systemic parts of the network to identify accounts with potentially elevated user privileges. What typically follows is the combined execution of a large repertoire of offensive tools, including Metasploit framework, malware propagation and Mimikatz hashing compromising tool. In brief, during the execution of LM, the aggressors occupy asset's account credentials of the low or medium access level of the targeted network, escalating their privileges up to their final target. This is achieved through various techniques, which are detailed in Sections 5 and 6.