Cybersecurity Concepts: Lateral Movement, Privilege Escalation, MITM & DoS Link to heading

Lateral Movement Link to heading

Lateral movement is the process of moving from one compromised system to another system within a network.

Why Attackers Perform Lateral Movement Link to heading

• The first compromised system rarely contains valuable data.
• Attackers must move across the network to reach their true targets.

Example Attack Path: Phishing email → User laptop compromise → Lateral movement → Domain controller → Full network control

Attacker Objectives:

• Find valuable data
• Reach domain controller
• Access admin accounts
• Deploy ransomware across the network

Common Lateral Movement Techniques Link to heading

1. Pass the Hash (PTH)

   • Attackers steal password hashes from memory and reuse them directly.
   • Tools: Mimikatz, CrackMapExec
   • SOC Indicators: NTLM anomalies, logins without password usage

2. Pass the Ticket (Kerberos Attack)

   • Attackers steal Kerberos tickets to access other machines.
   • SOC Indicators: Suspicious ticket usage, unusual TGT activity

3. Remote Desktop Protocol (RDP)

   • Attackers use stolen credentials via port 3389.
   • SOC Indicators: Internal RDP connections, unusual login locations, off-hours login attempts

4. SMB/Windows Admin Shares

   • Attackers copy tools using \\target\C$.
   • Tools: PsExec, Impacket, CrackMapExec
   • SOC Indicators: Suspicious file transfers, admin share access, service creation events

5. Windows Management Instrumentation (WMI)

   • Allows remote command execution.
   • Example:

     wmic /node:target process call create "malware.exe"
     

   • Red Flag: Admin’s command line used to remotely execute malware.

Real SOC Scenario:

• Suspicious login to user laptop
• Mimikatz executed
• Admin credential dumping detected
• Attacker login to file server
• Ransomware deployed

Privilege Escalation Link to heading

Privilege escalation means gaining higher privileges than originally obtained.

Example Progression:
User account → Admin account → Domain admin/root

Attack Phases Link to heading

• Pre-engagement
• Passive reconnaissance
• Active reconnaissance
• Service enumeration
• Access exploited
• Privilege escalation

Types of Privilege Escalation Link to heading

• Vertical: User → Admin → Domain admin/root
• Horizontal: User → Another user (same level, different privileges)

Common Techniques Link to heading

1. Exploiting Software Vulnerabilities

   • Outdated kernel, vulnerable drivers
   • Process: Exploit → Admin access

2. Credential Dumping

   • Tools: Mimikatz, LSASS dumping
   • SOC Indicators: LSASS access, credential dumping alerts

3. Misconfigured Permissions

   • Writable executables running as SYSTEM

4. Token Impersonation

   • Steal Windows access tokens → Impersonate admin

5. Scheduled Task Abuse

   • Modify tasks running as admin

SOC Indicators Link to heading

• Sudden admin rights assignment
• New admin account creation
• Service creation events
• Suspicious LSASS access

Important Windows Event IDs Link to heading

Real Ransomware Attack Chain:
Phishing → Laptop compromise → Credential dumping → Privilege escalation → Lateral movement → Domain controller access → Ransomware deployment

MITM (Man-in-the-Middle) Link to heading

A MITM attack occurs when an attacker secretly intercepts communication between two parties.

Normal Flow: User ↔ Server
MITM Flow: User → Attacker → Server

Goals Link to heading

• Credential theft
• Session cookie capture
• Malware injection
• Data modification
• Monitor sensitive communications

Types of MITM Attacks Link to heading

1. ARP Spoofing

   • Attacker pretends to be router.
   • SOC Indicators: Duplicate MACs, ARP table changes, traffic rerouting

2. DNS Spoofing

   • Redirect domains to fake IPs (e.g., google.com → attacker server)

3. SSL Stripping

   • Downgrade HTTPS → HTTP

4. Session Hijacking

   • Steal cookies → Login without password

5. Evil Twin

   • Fake WiFi network intercepts traffic

Real SOC Scenario (MITM):

• Multiple users accessing same gateway IP
• SSL certificate mismatch
• Suspicious DNS responses

Investigation Steps:

• Check ARP table
• Check DNS logs
• Analyze traffic anomalies

MITM Prevention Link to heading

• HTTPS/TLS
• VPN usage
• Secure DNS
• Certificate validation
• Network segmentation
• WPA3 WiFi security

DoS & DDoS Link to heading

DoS (Denial of Service) Link to heading

• Overwhelm a server with packets.

DDoS (Distributed Denial of Service) Link to heading

• Massive traffic from multiple compromised devices.

Goals:

• Take website offline
• Disrupt operations
• Extortion
• Diversion for other attacks

Types of DDoS Attacks Link to heading

1. Volumetric Attacks

   • Flood bandwidth (UDP flood, ICMP flood)

2. Protocol Attacks

   • Target server resources (SYN flood, Ping of death)

3. Application Layer Attacks

   • Target apps (HTTP flood, login abuse)

Real SOC Example:
Traffic spike: 2k → 200k requests/sec
Sources: Multiple countries
Endpoint: /login → Application layer DDoS

SOC Indicators Link to heading

• Sudden traffic spikes
• Same request from multiple IPs
• High CPU/memory usage
• Increased latency
• Service downtime

DDoS Mitigation Link to heading

• Rate limiting
• Web Application Firewall (WAF)
• CDN (Cloudflare)
• Traffic filtering
• Load balancer
• IP blocking