Techniques to Deter Lateral Movement from Attackers

Introduction

Even if you have implemented a?Zero Trust?security paradigm for your network and infrastructure security, you need to plan for the inevitable: at some point, an attacker will get into your network with the intent to deploy ransomware or cause damage another way. ?

A typical attack goes something like this:

1. A threat actor compromises a user account through a phishing campaign, password-guessing attack, or other technique, gaining a foothold on an endpoint, IoT device or other system.
2. The attacker moves laterally through the environment and escalates their privileges until they gain access to vital IT resources. This stage can last weeks or even months as the attacker moves around and studies your network.
3. The attacker exfiltrates sensitive data, deploys ransomware or other malware, and/or damages systems to cause downtime.

?

There is a misconception that lateral movement threats are limited to on-prem networks. But lateral movement can also occur in cloud environments, and attackers can even move laterally between on-prem and cloud systems.

It’s?up to cybersecurity personnel to detect threats, contain attacks to prevent further spread, and clean all infected systems. To defend your organization, you need to understand the techniques that threat actors utilize.

What are lateral movement and privilege escalation?

Threat actors typically gain a foothold within a network by compromising an account with standard user privileges. However, the attacker will then try to gain higher levels of access and control. Accordingly, when an attacker enters your environment, they will begin with reconnaissance operations to understand what resources they have access to and what accounts they may be able to compromise next. They may use network scanning tools to identify live hosts, open ports, or running services within a targeted system platform. During this calm before the storm, it’s critical that you can detect and then respond to the threat quickly.

What specific techniques do attackers use?

Here are some of the most common techniques that attackers use to move laterally and escalate their privileges:

• LDAP reconnaissance?— Threat actors can query an LDAP directory service to gather information about objects and attributes in order to identify highly privileged [4]?accounts and critical resources to gain control over.
• Pass-the-Hash attack?— This technique involves stealing a password from a user with elevated privileges by intercepting network traffic or using malware to extract the password hash.
• Kerberoasting?— Adversaries can abuse the Kerberos authentication protocol to steal the credentials of?Active Directory?users that have servicePrincipleNames. More often than not, these accounts are service accounts, so they have higher levels of privilege than regular user accounts.
• Exploiting vulnerabilities?— This type of attack takes advantage of unpatched or outdated software, exploiting known vulnerabilities to elevate an attacker’s privileges or grant them access to additional systems.
• Abusing weak configurations?— Weak configurations on servers, endpoints, and other systems give adversaries multiple openings for their attacks.
• Leveraging RDP?— Remote administration tools, such as the Remote Desktop Protocol (RDP) in Windows systems, are often targeted by cyber criminals to move laterally within a network.

?

Hackers often utilize specialized tools designed for lateral movement, such as Bloodhound, PowerSploit, or Empire. These are used to map out the network and identify potential targets to exploit.

Real-World Examples

One highly publicized example of an attack featuring lateral movement was the SolarWinds supply chain attack of 2020. Threat actors gained access to SolarWinds software and inserted a backdoor into a software update. When customers installed that update, the attackers gained privileged access to their networks.

Another example that same year was a Ryuk ransomware attack on Universal Health Services. Here, the perpetrators used a phishing email to deliver a Trojan application, which then downloaded the ransomware. The cyber criminals then used?Mimikatz?to steal an administrator’s credentials in order to move laterally across the network.

How Can Organizations Defend Themselves?

To help prevent adversaries from moving laterally in your IT environment, consider implementing the following best practices.

Restrict local administrator access.

Gone are the days when you could assign local administrator rights to standard users. Now, doing so is a major security risk.[5]? When an account is compromised, the attackers will automatically inherit the rights of that account. Without local admin rights, however, attackers will be unable to install malicious code.

Enforce the principle of least privilege.

The?principle of least privilege?(POLP) states that each user and process should have access to only the network resources they need to perform their assigned job functions, and nothing more. Today, POLP has evolved to also include a temporal element: privilege should exist only as long it is needed for a certain task.

Block social engineering attacks.

Cyber criminals often gain access to a target IT environment through social engineering, an attack in which they manipulate a legitimate user into providing their credentials. This is where security awareness training can pay enormous dividends, as users are often the weak links in your security chain. There are also email and web filtering solutions available to mitigate these types of attacks.

Protect your passwords.

Weak passwords?make it easy for attackers to steal credentials using techniques such as?password spraying?attacks. Fortunately, there are tools that can help enforce complexity standards for all passwords. You should support these policies with proper cyber hygiene training for all users. In addition, multifactor authentication (MFA) should be applied to all high privilege accounts.

Replace standing privileged accounts with just-in-time access and monitor activity,

Administrative rights are the keys to the kingdom for a hacker. To protect them from being compromised, it’s essential to implement a solid?privileged access management?(PAM) strategy. One way is by using[6]? the?Netwrix Privileged Access Management Solution, which enables you to identify privileged accounts across your IT estate and reduce your attack surface by replacing them with just-in-time (JIT) access for completing specific tasks. Moreover, the solution gives you a clear view into what privileged users are doing across your IT environment and alerts you to suspicious behavior.

Conclusion

Lateral movement is a common technique from attackers. Make sure you cut off and contain them with the correct strategies, techniques, and tools.

?? CISA's advisory report?details a 2020 Red Team Assessment exposing a mature organization's vulnerability to cyberattacks. Despite its robust cybersecurity posture, the organization failed to detect a simulated attack. CISA identifies 13 critical events for detection, all of which can be addressed by Netwrix solutions. Explore how Netwrix can enhance your cyber defenses in the face of sophisticated threats by downloading the CISA Simulated Attack eBook.

?? Cyber Winter Wonderland: Enhancing Resilience in Information Security

Netwrix joins in the merriment, wishing you Happy Holidays and a cyber-secure New Year! Let's unwrap the secrets to taking your cybersecurity strategy from reactive to resilient with a new webcast series designed for CISOs, managers and IT admins. In the spirit of giving, we'll be awarding special prizes to the most active participants. As an additional treat for those who "sleigh" the Q&A session, we're also providing an opportunity to win a $10 Starbucks gift card voucher! This way, you can enjoy a little extra perk while participating in our discussions. Spread the holiday cheer, fortify your cybersecurity knowledge, and secure your spot in our winter wonderland webcasts!