# Revisiting the Detection of Lateral Movement through Sysmon
## 8 Conclusions  
In recent years, many organizations have suffered damages as a result of targeted LM. As it becomes apparent, the tasks of incidence response teams to further address such damages acquire significant weight. Many penetration testing tools leave no concrete evidence regarding their execution when filtered with Sysmon's default settings, leaving several data exfiltration incidents unsolved. In this context, the current study aspires to set the stage for a fresh EDR rule-based policy regarding Sysmon identification and alerting of LM events. In addition, a publicly available Python tool, namely _PeX_ is implemented, giving greater insight in terms of understanding the mechanisms that fall under LM methods.  
As an extension of the work conducted on this topic so far, the ultimate goal of the current work is the collection and investigation of evidential logs related to LM attacks. In short, the effort is concentrated on the creation of custom filtering Sysmon rules, along with the initialization of Sysmon's config.xml file specifically oriented towards the alerting of LM. The conducted analysis suggests two different sets of Sysmon rules, as presented in Appendices A.1 and A.2, one for each of the Exploitation of Remote Services and Credential Exploitation attack experiments, respectively. The adoption of the aforementioned rules comes as a direct result of the thorough network traffic and pattern study, as derived from the execution of each attack.  
With reference to the conducted experiments, the proposed rule-based approach was incorporated with Sysmon in the form of the _config.xml_ file, presenting an identification TP rate above \(\approx\)95%. Finally, yet importantly, the proposed EDR policy, including the _.lll_ analysis of Section 6.2.4, was imported and evaluated through _PeX_ against four subsets, revealing a tendency above \(\approx\)96% in terms of the TP and TN metrics. The combination of the proposed EDR policy with machine learning techniques may reveal its importance as the basis for the creation of an LM-oriented IDS solution. Nevertheless, a thorough investigation of this potential is well beyond the scope of this paper and is left for future work.  
Conceptualization, C.S., K.B. and G.K.; methodology, C.S., K.B. and G.K.; validation, C.S., K.B. and G.K.; formal analysis, C.S. and G.K.; investigation, C.S., K.B. and G.K.; writing--original draft preparation, C.S.; writing--review and editing, C.S., K.B. and G.K.; supervision, G.K. and K.B.; project administration, C.S. G.K. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
**Data Availability Statement:** The \"Python_Evtx_Analyzer (PeX)\" tool along with the large dataset of Sysmon logs collected during the experiments are made publicly available to the community for download at [[https://github.com/[PERSON]/Python_Evtx_Analyzer.git](https://github.com/[PERSON]/Python_Evtx_Analyzer.git)]([https://github.com/[PERSON]/Python_Evtx_Analyzer.git](https://github.com/[PERSON]/Python_Evtx_Analyzer.git)).  
The authors declare no conflict of interest.  
Figure 5: Confusion matrices for the evaluation percentages presented in Table 6, namely TP, TN, FP, FN rates, for _PeX’s_ execution per technique and subset; (**a**) Normal Subset; (**b**) NormalVsMalicious01 Subset; (**c**) NormalVsMalicious02 Subset; (**d**) FullSet Subset.