XDR: Lateral Movement

This room will discuss some of the Lateral Movement and Execution techniques from the perspective of a multi-stage incident in Microsoft Defender XDR.

• Firstly, we will look at the Lateral Movement concept.
• Then, we will see two sample techniques and tools for it, namely WinLNK and Mimikatz.
• Finally, we will investigate the multi-stage incident in Microsoft Defender XDR. While doing so, we will focus on the following parts of this incident, as each of them will help us to understand and build the attack narrative from a 360 view:
  • Attack story
  • Alerts
  • Assets
  • Investigations
  • Evidence and Response

With the hands-on part, in the lab environment, there will be also the chance to explore and investigate similar alerts and incidents in Microsoft Defender XDR lab environment.