Detecting Lateral Movement

Lateral movement is the phase between a single compromised host and a domain compromise — and it uses the same tools your administrators use, which is exactly why it hides. An attacker with stolen credentials reaches other systems via PsExec, WMI, remote scheduled tasks, and RDP: all legitimate remote-execution methods. You cannot detect them by blocking the tools; you detect the relationships — which host is executing on which, and whether they have any business doing so. This guide ships the signals and the segmentation that shrinks the attacker’s reach.

Lateral movement maps to MITRE ATT&CK T1021 — Remote Services and T1570 — Lateral Tool Transfer. It rides on credentials taken via LSASS dumping and often precedes DCSync.

What is lateral movement?

After landing on one machine, an attacker rarely finds what they want there. Lateral movement is how they spread — using the credentials they have stolen to authenticate to other systems and run code on them, hopping toward domain controllers, file servers, and backups. The methods are the standard Windows remote-administration toolkit, which is the whole problem: PsExec, WMI, WinRM, RDP, and scheduled tasks are how admins legitimately manage fleets, so the traffic blends in.

The defensive answer is context. A workstation executing a service on another workstation, or a normal user account RDP-ing into a domain controller, is abnormal even though the mechanism is legitimate. Detection is about the source-destination-account relationship.

What are the main lateral-movement techniques and signals?

The common denominator is a remote-execution event arriving at a host from a source that does not normally administer it. Baseline the legitimate admin-to-host relationships, and the anomalies are the movement.

How to detect lateral movement

The highest-signal single rule is a PsExec-style service install, which is rare and noisy-when-malicious.

title: Remote Service Execution via PsExec
id: 8c1f4a93-darkpwn-illustrative
status: experimental
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ServiceName|contains: 'PSEXESVC'
  variant:
    ServiceFileName|contains: ['\\\\','\ADMIN$\', '-service']
  condition: selection or variant
falsepositives:
  - Legitimate admin use of PsExec from jump hosts (allowlist source hosts/accounts)
level: high

How to test your lateral-movement detection

In an isolated lab you own:

1. Run PsExec from a lab admin host to another and confirm the 7045 rule fires; allowlist the legitimate source.
2. Execute a remote WMI process creation and confirm the wmiprvse.exe-parent signal appears.
3. RDP into a lab server and confirm the 4624 type-10 logon is captured.
4. Confirm normal admin-from-jump-host activity is allowlisted and quiet.

How to prevent and contain lateral movement

• Disable unused remote-admin protocols on workstations.
• Alert on any interactive logon to a domain controller outside a tiny allowlist.
• Harden credential theft upstream — LSASS and phishing-resistant MFA.

Common lateral-movement detection mistakes

• Trying to block the tools. Breaks admin work; attackers switch methods.
• No cross-host correlation. Movement is a relationship across machines, not one event.
• No baseline of admin relationships. Everything looks either normal or suspicious.
• Ignoring direction. Movement toward Tier 0 is the high-priority case.

Lateral movement detection checklist

1. Collect service installs (7045), WMI activity, RDP logons (4624 type 10), remote tasks (4698).
2. Alert on PsExec (PSEXESVC), WMI remote spawns, and RDP to sensitive hosts.
3. Baseline legitimate admin-to-host relationships; alert on deviations.
4. Correlate logon → remote execution → direction across hosts.
5. Prioritize movement toward Tier 0 (domain controllers).
6. Segment the network; restrict admin protocols to jump hosts.
7. Enforce tiered administration, LAPS, and MFA for remote access.
8. Test each technique in a lab and allowlist legitimate admin sources.

The takeaway

Detecting lateral movement means watching the legitimate remote-execution methods — PsExec, WMI, RDP — as relationships: a source executing on a destination it never normally touches, moving toward higher value. Baseline the admin paths, correlate across hosts, and contain with segmentation and tiering. Continue with DCSync detection and process injection detection, or browse the full Detection Engineering pillar.