Threat Hunting: Pivoting

Is your organisation's network robust enough to spot lateral movements of adversaries within your systems? Can you detect unusual network activities or illicit privilege escalation that could indicate a pivot attack? Can you use network telemetry and analytics to identify abnormal behaviour and halt lateral movement before it wreaks havoc?

These are essential questions to mull over when considering the critical pivoting stage in the cyber kill chain. Cyber threat actors, every day, devise innovative methods to move laterally within compromised networks, exploiting credentials, network misconfigurations or unpatched software to extend their foothold. As a security team, you are responsible for safeguarding the network perimeter and continuously monitoring for anomalous internal activities to intercept the attackers during their stealthy lateral movement. The task can be overwhelming, given the subtle nature of pivot attacks and the tenacity of modern cyber criminals.

Learning Objectives

In this room, we will learn to hunt malicious activity indicating potential internal network pivoting in continuation of achieving an initial foothold. By the end of this room, you will be able to:

• Understand the attacker's mindset in moving inside the compromised internal network
• Correlate succeeding actions executed by an attacker after establishing persistent and continuous internal access
• Differentiate suspicious host and network events from benign ones
• Get acquainted with the MITRE Tactics involved once an attacker attempts to jump from one machine to another

Prerequisites

It's recommended you complete the following rooms before proceeding with this room:

• Windows Event Logs 
• Core Windows Processes
• Advanced ELK Queries 
• Threat Hunting: Introduction
• Threat Hunting: Foothold