Why Lateral Movement Matters
The initial compromise is rarely the target. An attacker lands on a developer laptop via a phishing email. The real target is the domain controller, the database server, or the cloud admin console. Getting there requires lateral movement — hopping from system to system, escalating privileges at each step.
Lateral movement is the phase where detection matters most. Before it, you have a compromised endpoint. After it, you have a compromised network. The difference between a minor incident and a catastrophic breach happens in the minutes and hours of lateral movement.
Techniques and Detection
Each lateral movement technique has observable network and host-level indicators.
Pass-the-Hash
Instead of cracking a password, the attacker uses the NTLM hash directly to authenticate. This produces network authentication events where the same hash is used from different workstations — a pattern that never occurs in normal operations. 1-SEC's Network Guardian monitors for hash reuse across multiple hosts and flags it immediately.
Kerberoasting
The attacker requests Kerberos service tickets for service accounts, then cracks them offline to extract plaintext passwords. The detection signal is a single user requesting an unusual number of service tickets in a short period — normal users rarely request more than a handful per session.
Golden Ticket Attacks
With access to the KRBTGT account hash, an attacker can forge Kerberos tickets with arbitrary privileges. Golden tickets have anomalous characteristics — unusually long lifetimes, privileges that don't match the user's actual role, and ticket-granting tickets issued outside normal domain controller processes.
DCSync
By impersonating a domain controller, an attacker can request password data for any account in Active Directory. DCSync generates replication traffic from a machine that isn't a domain controller — a clear indicator that's trivially detectable if you're watching for it.
The Correlation Advantage
Individual lateral movement indicators can be noisy. But when you correlate across modules, the picture becomes clear. A Kerberoasting attempt followed by authentication from an unusual workstation followed by access to a file share that user never touches — that's a lateral movement chain, and 1-SEC's event bus connects these signals across the Network Guardian, Auth Fortress, and Runtime Watcher in real time.