What is Lateral Movement? + Detection & Defense Measures

Lateral movement is a lesser known but incredibly insidious hacking tactic. It is a significant step in many different common cyberattacks, and it can be difficult to trace in your network. This subtle kind of attack can be incredibly devastating to a small business. What exactly is lateral movement?

Lateral movement occurs when a hacker gains access to your network & uses their skills to expand that access. It involves reconnaissance, privilege escalation, & gaining further access. Once those stages are complete, they take the data they came for, leaving back doors so they can return.

There’s a lot of nuance to the steps of a lateral movement attack, but you can detect and prevent them. Read on to find out more about the signs that you (or your cybersecurity team) should look for, how you can defend yourself, and more!

What Lateral Movement Looks Like

The reason that lateral movement goes undetected is that it is a series of techniques designed to mimic your normal network activity. That means that some of your general cyber defenses may not catch lateral movement right off the bat.

In cybersecurity every second counts. Knowing what lateral movement looks like can mean the difference between falling prey to an attack – or stopping one in its tracks.

The Steps Of Lateral Movement

Step 1 – Reconnaissance

Once a bad actor gains initial access to your network, they begin the reconnaissance stage. This step involves the attacker building a map of your network, users, and connected devices.

They need to get the lay of the land in order to establish their next objective. Unfortunately, hackers can use some of your built-in infosec tools against you while doing their reconnaissance.

Netstat tells them your current network connections, which can identify important devices. IPConfig tells them about your network structure and location. Your ARP cache can reveal your IP Address and the physical address it’s linked to. Your routing table explains your communication paths for the connected host. And last but not least, PowerShell (a command line and scripting tool) can help the cybercriminal identify the accesses afforded to the user they’ve compromised.

Step 2 – Privilege Escalation

After they survey and map your network’s landscape, the bad guy knows exactly what access to go for next. It helps them get the most data out of your system. This step is known as privilege escalation. The attacker will do everything they can, using a number of techniques, to gain higher level user login information.

The techniques most commonly used in privilege escalation are social engineering, phishing, keylogging, and malware. Social engineering and phishing rely on good old fashioned manipulation to get users to give up their login credentials. 

Keylogging involves a tool that tracks every keystroke entered on a device. If the hacker knows which device a high level user uses, they can install a keylogger and steal their password.  

Other malware tools can authenticate high level user access using partial or expired passwords. They then create tickets that authenticate access without passwords at all, or steal authentication certificates from legitimate devices.

Step 3 – Gaining Access

The final step of a lateral movement attack occurs when access has been gained and the attacker compiles the data they intend to steal. This network traffic is almost indistinguishable from legitimate network traffic. It is crucial to detect and stop an attack before it reaches this point.

When an attacker is done compiling the data they want to steal, they exfiltrate it to their server. The attack may not be finished, though. Most cybercriminals leave a backdoor into your network at this stage, so that they can return and steal more data. If the attack isn’t detected, they could come back indefinitely to mine your data.

How To Detect Lateral Movement On Your Network

Detecting lateral movement while it’s happening and stopping it before the bad guys can complete their objective is paramount. Most prevention tools won’t detect this activity on their own. Although using built-in network tools and your user access goes a long way to mask the activity of a criminal performing lateral movement, there are ways you can spot them.

Real-Time Monitoring

The first step towards detecting lateral movement attacks is to gather and track data about your network activity. Monitoring your legitimate users and knowing how they typically access data on the network is crucial.

There are a number of tools and frameworks that can track and collect this data, as well as automatically alerting you to any traffic that doesn’t fit those established patterns. Receiving alerts when unusual traffic occurs can keep your traffic visible and show you how it ebbs and flows.

Behavioral Analytics

Once you receive an alert about any unusual traffic, using behavioral analytics to review that alert and figure out if it’s a threat or not comes next. User and Entity Behavior Analysis (UEBA) tools rely on machine learning to establish a baseline for activity on your network and rate the severity of each deviance from that baseline. 

Once these tools do that, they can also warn you when a normal user is behaving inappropriately, like attempting to access admin level folders, or when an admin user is abusing their administrative access. This kind of tracking and monitoring of behavior can help prevent internal data compromises or theft as well as lateral movement.

Honeypots

If you want to be extra certain when you catch suspicious network activity, you and your security team can set up honeypot servers or folders to ensnare unsuspecting hackers. Give them a juicy name like “Payroll” or “Finances”, and put some false data in there to flesh it out. 

Now you’ve set the trap, and you know without a shadow of a doubt that your legitimate users have no reason to access the false server/folders. Any exploration of this honeypot should immediately be a huge red flag that your network is under attack.

Defend Your Data

So, you’ve set up your detection tools and feel good about your ability to sniff out any lateral movement taking place on your network. But you want to do MORE. Detection isn’t enough for you. You’ve come to the right place.

These measures will help you prevent lateral movement attacks. It’s important to remember that the landscape of cybersecurity is always changing, so no prevention tool is 100%. But these are the best methods with which you can protect yourself and your business right now. 

Zero Trust Security

This is more than a security tool, it’s a security mindset. If you build your cybersecurity protocol with a Zero Trust model, you’re much more likely to prevent all kinds of cyber attacks.

Zero Trust is exactly that. With this mindset you approach all users and devices as though they present a threat to your network.  This involves continually re-authenticating any and all users and devices, to ensure that no threats are present.

Another aspect of the Zero Trust mindset is that you give your users the least access possible in order for them to successfully do their jobs. No one should have access privileges that they don’t need or use regularly. This helps you divide your network into small and more secure segments.

These components make it much harder for cybercriminals to escalate their privileges if they do gain access to one of your user profiles. Plus, it makes clean-up much easier as you can quarantine each small segment of your network as needed.

Learn more about our cybersecurity mindset and packages here.

Penetration Testing

Penetration testing involves trusted cybersecurity experts or white-hat hackers attempting to hack your network to expose vulnerabilities you didn’t know that you had. They’ll push the limits of your security measures and see how far they can get without being detected.

At the end of this hacking exercise, they’ll report back to you exactly what they found and make recommendations to tighten security to you and your security team. If utilized regularly, this is a surefire way to ensure that your security is top notch, even as threats evolve and change.

Endpoint Security

An endpoint device is a desktop, laptop, smartphone, tablet, or anything that communicates with a network that it’s connected to. Endpoint security is anti-malware software that is installed on endpoint devices to scan and monitor for cyber threats.

If you don’t already have a good antivirus and anti-malware program, it’s time to invest in one. If you do, you also need to be sure that updates are automated across your business. Your security software is only as strong as the version you’re using, so if you get behind on updates you’re exposed to any threats that arose after the software was installed.


The security experts at CloudNexus are equipped to handle detection and defense of lateral movement on your business’ behalf. Reach out here and get started today.