Unveiling the Dependency on Network Telemetry: Optimizing Lateral Movement Detection

Lateral movement is a critical phase of adversarial activity during cyberattacks, enabling attackers to traverse a network, escalate privileges, and exfiltrate sensitive data. Identifying adversaries in complex networks presents significant challenges due to adversaries’ use of legitimate tools and processes to evade signature database detection.

This study investigates the dependency on network and endpoint telemetry for identifying lateral movement attacks, focusing on the Remote Services technique from MITRE ATT&CK.

The findings emphasize the importance of leveraging anomaly behavior analysis, whether applied to network or endpoint telemetry, to unveil adversarial activities that might otherwise blend with legitimate operations. Lateral movement techniques, identified in MITRE ATT&CK and this study, highlight the need for robust network visibility tools and micro-segmentation strategies to limit adversaries’ network propagation while ensuring comprehensive threat visibility and correlation.