# Revisiting the Detection of Lateral Movement through Sysmon
## 4 Testbed  
For the purposes of log file gathering (in.csv,.evtx,.xml form), as depicted in Figure 1, we created a mixed testbed comprised of both virtual and physical stations that realistically emulates a typical SOHO environment. In total, eight different physical and Virtual Machines (VMs) were utilized. Three of them were used as client stations (1 Ubuntu Desktop 20.0.4 LTS, 1 Kali Linux Desktop 2020.4 LTS, 1 MS Windows 10), one both as the client station and host PC on which VMs have been installed, and two smartphones as clients (1 Android smartphone Samsung A8 and 1 iOS iPhone XR). Moreover, one physical laptop (MacBook Air) simulated the attacker's interface. Finally, one MS Windows Server 2019 64-Bit was created as a VM station to dissemble the malicious LM's final target. The wireless Access Point (AP) was a SERCOM Speedport Plus router. The SOHO's network topology is presented in detail in Figure 1, while the role and the characteristics per machine are included in Table 2.  
To simulate as realistically as possible the workload of a typical SOHO network, the _SYSMON_SET domain_ was created within an MS Windows 2019 Server VM. Six client accounts were configured and initialized via the _MS Windows Server Account Management_ service and joined the SYSMON_SET domain. For the needs of the execution of the various credential exploitation attacks detailed in Section 6.2 each of the server's accounts was granted domain administrative privileges in advance.  
Figure 1: High-level view of the testbed network topology. The MS Windows Server 2019 uses a wired connection with the AP, presented as a double green line. The network traffic flow for disparate categories of VM and physical stations is shown in a different color, namely green for Wi-Fi traffic and red for the attacker.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & & & & & & & & \\ \hline \multicolumn{1}{c}{**Technical Characteristics and Utilization of Each STA (Physical and VMD)**} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \\ \hline
**Station** & **Type** & **Operating System** & **Kernel\_Version** & **CPU/RAM** & **IP\_Address** & **MAC\_Address** & **Username** \\ \hline AP & Wireless\_AP & SERCOM\_Firmware & 0092001.0031 & - & 80.107.57231, & & \\  & & & OTE2 & - & 192.168.11 & & \\ \hline Client STA 1 & VM & Ubuntu 20.04 & 5.80-53-generic-\(\times\)64 & VM dual\_core, 2 GB & 192.168.16 & 08:00:27:46:45e6 & admmichr \\ \hline Client STA 2 & VM & Kail 2021.1 & 5.100-kall\_amd64 & VM dual\_core, 2 GB & 192.168.11 & 08:00:27:36:54.7 & ricksitas \\ \hline Client STA 3 & VM & Win10 Eval. x64 & 2004 & VM dual\_core, 2 GB & 192.168.17 & 08:00:27:36:54.9 & chrsmith \\ \hline \multirow{2}{*}{Client STA 4} & \multirow{2}{*}{Laptop} & \multirow{2}{*}{Win10 Home x64} & \multirow{2}{*}{2004} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \multicolumn{1}{c}{} & \\ \cline{5-5}  & & & & & & & \\ \cline{5-5}  & & & & & & & \\ \hline Windows 2019 Server & VM & Win2019 Server x64 & 1899 &
\begin{tabular}{c} VM dual\_core, 2 GB \\ VM RAM \\ \end{tabular} & 192.168.18 & 08:00:27:46:32.32 & christosssimilotopoulos \\ \hline Client STA 5 & Smartphone & iOS 15.0 & 14.4.2 & Hexa-core, 64 GB & 192.168.1.3 & 06:16:EC8:18:96.8 & iPhone-Christos \\ \hline Client STA 6 & Smartphone & Android 9 & Knox 3.3 & Eyynos 7 Octa 7885 & 192.168.1.13 & 3:CDC:BC:76:77:38.7 & A-Maraki \\ \hline \hline \end{tabular}
\end{table}
Table 2: Summary of key technical characteristics related to the machines utilized during the execution of the LM experiments.