# Revisiting the Detection of Lateral Movement through Sysmon
## 2 Related Work
Numerous DLL files were collected and analyzed from four different tools, namely China Chopper, Mimikatz, PowerShell Empire, and HUC Packet Transmitter, to reveal the existence of significant differences in the specific files among various versions of the MS Windows Operating System (OS) and the aforementioned tools. The work concludes with the extraction of a list with the commonly loaded DLLs per tool, regardless of the Windows OS environment and the introduction of a detection-specific logging method based on the open-source ELK Stack. The researchers in [11; 12] also attempted to introduce a DLL-oriented malware detection methodology through the analysis of potentially malicious files on sandbox environments, such as _Cuckoo_. However, only the authors in [10] proposed a list with the most commonly appeared DDL files related to malicious intrusion tools. Additionally, the contributions in [11; 12] relied on classification techniques with Machine Learning (ML) algorithms, which at this point fall out of the scope of the current research. It can be said that the enhancement of the DLL detection policy, particularly focused on each LM method used for Sysmon event logs, will expand the detection accuracy and diminish the false positive results. The ELK Stack was also used by the authors in [13; 14] for the analysis of massive log records and the identification of malicious behavior. Specifically, the work in [13] implemented a _logstash_ massive data processing pipeline to collect a critical mass of logs, whereas [14] generated Sysmon logging events. In both cases, the ELK stack was utilized for log file iteration and the identification of malicious patterns. On the downside, both works were tightly bonded to ELK stack practices, neglecting the need for a general purpose rule-based EDR system. The work in [15] focused on Advance Persistent Threat (APT) detection of the Mimikatz password stealing tool utilized in the context of LM. To increase the true positive rates, the authors implemented _Mutex_ memory objects in parallel with the identification of Mimikatz-related DLL files. It can be argued that even with the introduction of _Mutex-oriented_ DLL file analysis, the Mimikatz tool can be deliberately obfuscated by the adversary, thus evading identification by even advanced EDR and IDS systems. Last but not least, the work in [16] considered the detection of malware Application Programming Interface (API) call patterns for the identification of behavioral anomaly signatures. Despite the high true positive rates, the proposed methodology affects the performance of the examined system and omits it from incorporating Sysmon event logs. On the other hand, the authors in [17] suggested an LM detection system, dubbed \"Hopper\", which is fed by real-life generated logs. The user's login activity was tracked and outlined through a graph of interrelated logins among the implicated hosts. This contributes to anomaly detection among logins, referring to LM attacks. On the flip side, despite \"Hopper\" effectiveness, the system ignores logs generated with Sysmon. In this respect, the aforementioned two papers are considered out of the scope of this study.