What is Lateral Movement?

Common Lateral Movement detection methods

The tracking of privileged accounts is essential for detecting lateral movement. as adversaries often seek to escalate privileges and use high-level accounts to access additional systems. While Nile includes these capabilities to identify threats, we do suggest that these become common practices for IT organizations that are still using a traditional network architecture based on VLANs and Layer 2 segmentation.

Identify anomalous network traffic

Monitoring network traffic for anomalies is a key method for detecting lateral movement. Unusual patterns, such as increased traffic between internal systems that do not typically communicate or unexpected data transfers, can indicate an attack in progress. Network behavior analysis tools can identify these anomalies by comparing current traffic to established baselines.

Nile provides a capability that detects individual devices that attempt MAC spoofing and will quarantine a device if this activity is identified.

Monitoring of privileged account usage

Tracking the usage of privileged accounts is essential for detecting lateral movement. Attackers often seek to escalate privileges and use high-level accounts to access additional systems. Monitoring for unusual login attempts, especially from different geographic locations or outside normal working hours, can help identify compromised accounts.

Nile recommends the use of Single Sign-on for user authentication as re-authentication of credentials through the lifecycle of a connection is a standard practice.

Endpoint detection and response (EDR)

The use of EDR solutions provide real-time monitoring and analysis of activities on endpoint devices. These tools can detect suspicious behaviors, such as the execution of uncommon processes, the use of hacking tools, or changes to system configurations. EDR solutions can generate alerts when such activities are detected, enabling quick investigation and response.

Nile suggests the use of solutions like CrowdStrike if using the Nile Access Service or a traditional network architecture with add-on NAC solution.

Log analysis

Comprehensive log analysis is critical for detecting lateral movement. Security information and event management (SIEM) systems aggregate and analyze logs from various sources, such as firewalls, servers, and endpoints. By correlating events across the network, SIEM systems can identify patterns indicative of lateral movement, such as multiple failed login attempts followed by successful ones.

Nile provides built-in SIEM integration with Splunk, but the use of any major SIEM solution is recommended if using the Nile Access Service. It is a must for anyone using a traditional network and legacy architecture.

Entity and User Behavior Analytics (EUBA)

Taking advantage of a EUBA (Entity and User Behavior Analytics) solution involves analyzing user or device activities to detect deviations from normal behavior. Machine learning algorithms can establish baselines for individual user behaviors and flag activities that deviate from these norms. For example, if a user account starts accessing files or systems that are atypical for their role, UBA can generate alerts for further investigation.

EUBA solutions are valuable and can be complex and expensive. Nile provides a service that identifies if a specific endpoint device changes its behavior and has the ability to remediate the situation as needed.