Network events can play a crucial role in our ability to detect and establish connections between suspicious lateral movements within a system. By analyzing these events, we can identify potential attackers attempting attacks such as Ingress/Lateral Tool Transfer and Kerberoast Attack within the network. Uptycs XDR can now provide a powerful solution for detecting and mitigating such threats. Its advanced capabilities enable us to correlate and analyze network events, proactively identifying and responding to unauthorized lateral movements. With Uptycs XDR, we can strengthen our overall security posture by promptly detecting and thwarting potential attacks aimed at exploiting lateral movement vulnerabilities.

Here is an illustration of how Uptycs XDR Detection detects an attacker trying to transfer tools laterally.

The attacker laterally transfers tools to a Windows machine via smbclient tool running on a Linux machine, as shown in Figure 1.

Our advancements in telemetry have taken us to a new level of detection, enabling us to gather comprehensive information on various lateral movement techniques. By utilizing RPC (Remote Procedure Call) Events, we can effectively collect and identify specific activities related to lateral movement within our systems. These activities encompass a range of potentially malicious actions, including the notorious DCSync attack, the creation of remote services, the scheduling of remote tasks, the utilization of a remote registry, and attempts by attackers to enumerate user or domain-related data. 

Threat actors commonly employ these techniques with the intent to gather sensitive information or establish persistent access to remote systems within our organization. By harnessing the power of RPC Events, we can significantly enhance our ability to detect and respond to such lateral movement attempts, bolstering our overall security posture and safeguarding our critical assets from potential exploitation.

Several examples of lateral movement techniques and Uptycs XDR detections are shown below.

By leveraging PSExec, an attacker has exploited a victim's NTLM hash, acquired through a DCSync attack, to create a service on a remote system.

To effectively identify and detect highly sophisticated attacks, such as the persistent and widely employed Kerberos Attack, Pass the Hash, and Pass the Ticket techniques, we have implemented additional signals that rely on telemetry correlation techniques applied to a multitude of underlying metrics. These signals serve as vital indicators in our defense mechanisms, enabling us to identify and respond to these malicious activities proactively. We can uncover patterns and anomalies indicative of these specific attack methods by analyzing and correlating various metrics. This comprehensive approach allows us to stay ahead of sophisticated adversaries and fortify our security measures, safeguarding our systems and data from the potentially devastating consequences of such attacks.

Here is an illustration of how Uptycs XDR can detect the above-mentioned attacks:

Sophisticated attacks typically involve the compromise of multiple systems within a network. In such scenarios, detecting and correlating lateral movement becomes crucial. When you use Uptycs XDR for threat detection you can effectively prioritize incidents and gain a comprehensive understanding of the attack progression. 

By analyzing and correlating the various lateral movement activities, we can establish the connections between compromised systems, allowing us to piece together a clear picture of how the attack has unfolded and spread across the network. This valuable insight enables us to significantly enhance our incident response capabilities and bolster our defenses against sophisticated and multi-faceted cyber threats.