Listen to this Post
Introduction:
Lateral movement and user impersonation are the cornerstones of a successful cyber attack, allowing adversaries to pivot from an initial foothold to domain-wide compromise. Understanding these “shadow steps” is critical for both red teams testing defenses and blue teams building them. This article provides a technical deep dive into the key techniques and, more importantly, the commands and logs needed to detect them.
Learning Objectives:
- Understand the mechanics of common lateral movement attacks like Pass-the-Hash and Kerberoasting.
- Learn to execute and subsequently detect these attacks using common offensive security tools.
- Build a foundational knowledge of hunting queries and command-line forensics to identify adversary activity.
You Should Know:
1. Pass-the-Hash (PtH) Attack Execution
Verified command list:
`sekurlsa::pth /user: /domain: /ntlm: /run:cmd.exe`
`crackmapexec smb -u -H –local-auth`
Step‑by‑step guide:
This technique allows an attacker to authenticate to a remote system using a user’s NTLM hash instead of the plaintext password. From an elevated command prompt on a compromised machine, use the first command with Mimikatz to spawn a new command window injected with the stolen credentials. This new shell can then be used to access network resources as that user. The second command, using CrackMapExec, can test the validity of a hash across a range of systems to find where that user has access, facilitating lateral movement.
2. Detecting Pass-the-Hash with Windows Event Logs
Verified command and log query:
`Get-WinEvent -FilterHashtable @{LogName=’Security’; ID=4624; Data=’3′} | Where-Object {$_.Properties[bash].Value -eq ‘NTLM’}`
`XPath Query for SIEM: EventID=4624 and LogonType=3 and AuthenticationPackageName=NTLM`
Step‑by‑step guide:
A successful PtH attack will generate a Windows Event Log entry (ID 4624, a successful logon) with specific key details. The `Logon Type` will be `3` (network logon) and the `Authentication Package` will be NTLM. The PowerShell command above queries the local Security event log for these exact criteria. Security teams should baseline normal NTLM traffic and then hunt for logons from unusual source workstations or at anomalous times.
3. Kerberoasting Attack Execution
Verified command list:
`setspn -T
`python3 GetUserSPNs.py / -dc-ip -request` (Impacket)
`hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt`
Step‑by‑step guide:
Kerberoasting targets service accounts in Active Directory that use Kerberos authentication. Attackers first query the domain for all Service Principal Names (SPNs) which correspond to service accounts. Using the Impacket script, they request Kerberos service tickets for these accounts. These tickets are encrypted with the service account’s password hash and are exported to a file. The attacker then offline cracks these hashes using a tool like Hashcat to reveal the plaintext passwords of often-privileged service accounts.
4. Detecting Kerberoasting Activity
Verified command and log query:
`Get-WinEvent -FilterHashtable @{LogName=’Security’; ID=4769} | Where-Object {($_.Properties[bash].Value -like ‘$’) -and ($_.Properties[bash].Value -eq ‘0x0’) -and ($_.Properties[bash].Value -ne ‘0x0’)}`
`SIEM Correlation: EventID=4769 (Kerberos Service Ticket Request) + AccountName ends with ‘$’ (computer account) + TicketEncryptionType=0x17 (RC4) + FailureCode=0x0 (Success)`
Step‑by‑step guide:
Detection focuses on Windows Event ID 4769: A Kerberos service ticket was requested. A key indicator is a massive spike in requests for service tickets (TGS-REQs), particularly for accounts whose names end with `$` (indicating a computer account). Furthermore, if the ticket encryption type is the weaker RC4_HMAC_MD5 (0x17), it is a strong signal of an attack, as modern tools will preferentially request this weaker encryption to make cracking easier. The PowerShell command helps filter for these suspicious successful requests.
5. Token Impersonation with Meterpreter & Empire
Verified command list:
`getsystem` (Attempts automatic privilege escalation)
`use incognito` (Meterpreter)
`list_tokens -u` (Lists available tokens)
`impersonate_token `
Step‑by‑step guide:
Token impersonation exploits the Windows security context mechanism. After gaining an initial shell, an attacker uses the `getsystem` command or exploits a vulnerability to gain SYSTEM-level privileges. They then load the `incognito` extension to handle tokens. The `list_tokens -u` command displays all available delegation tokens for other users on that system. If a Domain Administrator has logged onto the compromised machine, their token will be available, and the attacker can use `impersonate_token` to become that user instantly, inheriting all their privileges on the network.
6. OSQuery for Endpoint Investigation
Verified command list:
`osqueryi`
`SELECT FROM processes WHERE on_disk = 0;` (Detects fileless execution)
`SELECT FROM listening_ports;` (Lists all open ports)
`SELECT name, path, pid FROM processes WHERE name LIKE ‘%mimikatz%’ OR path LIKE ‘%mimikatz%’;`
Step‑by‑step guide:
OSQuery exposes operating system data as a high-performance relational database, allowing you to run SQL queries to investigate endpoints. Start the interactive shell with osqueryi. To hunt for malicious activity, query the `processes` table for anomalies like processes running from RAM (on_disk = 0), a common indicator of fileless malware like PowerShell attacks. You can also quickly list all listening ports to identify unauthorized services or scan running processes for known malicious names like “mimikatz”.
7. Hunting for Lateral Movement with Wireshark Filters
Verified command and filter list:
`tcp.flags.syn == 1 and tcp.flags.ack == 0` (SYN Scans)
`smb2.cmd == 5 && smb2.flags.response == 0` (SMB Tree Connect Requests)
`kerberos.CNameString contains “$”` (Kerberos requests for computer accounts)
Step‑by‑step guide:
Network traffic analysis is vital for detecting lateral movement. In Wireshark, use display filters to isolate suspicious behavior. Filter for `tcp.flags.syn == 1 and tcp.flags.ack == 0` to find SYN scans, the first step in network reconnaissance. The filter `smb2.cmd == 5` will show all SMB2 Tree Connect requests, which are made when a client attempts to access a file share on another system—a common lateral movement action. The Kerberos filter helps identify requests related to machine accounts, which could be precursor activity to attacks like Kerberoasting.
What Undercode Say:
- Offense Informs Defense: You cannot effectively defend against an attack you do not understand. Hands-on execution of these techniques in a lab environment is the single best way to learn the telemetry they generate.
- Focus on Logging: The attacks themselves are often inherent to the design of the protocols. The real battle is won by enabling, collecting, and analyzing the correct logs (especially Windows Event Logs) to detect the anomalous activity they create.
The sophistication of modern adversaries lies not in the complexity of a single technique, but in the chaining of simple, trusted actions into a devastating attack path. The core attacks for lateral movement have remained largely unchanged for years because they abuse fundamental trust mechanisms in Windows environments. This means detection cannot rely on IOCs alone but must be based on a deep understanding of normal user and system behavior to spot the subtle anomalies that indicate abuse. Investing in foundational logging and analyst training provides a greater return than chasing the latest zero-day.
Prediction:
The future of lateral movement will see a continued shift towards “living off the land” using built-in tools and software distribution systems, making detection even more challenging. We will see increased abuse of cloud identity and access management (IAM) protocols for lateral movement between hybrid on-premise and cloud environments, as the perimeter dissolves. Furthermore, the integration of AI by attackers will automate the discovery of complex, custom attack paths specific to a target’s environment, drastically reducing the time between initial compromise and domain escalation. Defensive AI will become necessary to correlate weak signals across massive datasets to identify these attacks in real-time.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Jean Francois – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
