huntress.comwriteupLateral Movement Attack: Techniques, Detection & Prevention
Huntress details how its Managed EDR and ITDR products detect lateral movement by correlating remote authentication events with subsequent process execution (action pillars: initial code execution, transport, remote authentication, remote code execution) rather than tracking source-side network connections. The piece walks through real-world scenarios including MMC20.Application DCOM abuse, LSASS credential dumping via rundll32/comsvcs.dll (as used by Impacket dcomexec.py and NetExec mmcexec.py), SQL Admin account abuse to enable RDP, and ransomware-precursor activity (shadow copy deletion, ntds.dit exfiltration) caught before payload deployment.
Organisations named here
- MMC20.Application
Technologies named here
- Huntress Managed EDR
- Windows
- Microsoft 365
- Huntress Managed ITDR
- Entra ID
- Mimikatz
- Google Workspace
- Impacket
- SQL Server
- CrackMapExec
- NetExec
- GoExec
- EDR
- RDP
- WMI
- PowerShell
Techniques named here
- Remote Desktop Protocol lateral movement
- DCOM/DCE-RPC remote object activation
- PowerShell Remoting
- Remote Services & Scheduled Tasks
- Server Message Block abuse
- WinRM abuse
- Credential theft / LSASS dumping
- Pass-the-hash
- Reconnaissance / network mapping
- Shadow copy deletion
- Clearing logs
- Killing security tooling processes / stopping core services
- Credential/data staging and exfiltration
- RDP enablement via registry
- Credential stuffing / brute-forcing
Related in Blue Team & Detection
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup