Detecção de Movimentação Lateral

Quando Usar

Use esta funcionalidade quando:

• Equipes de SOC precisarem detectar atacantes se movendo entre sistemas após um comprometimento inicial.
• Investigações de incidentes exigirem o rastreamento do caminho de movimentação de um atacante pela rede.
• Engenharia de detecção precisar de regras de movimentação lateral mapeadas para as técnicas TA0008 do ATT&CK.
• Exercícios de equipe vermelha/roxa identificarem lacunas na detecção de movimentação lateral.

Não use para detectar acesso inicial ou ataques externos — a detecção de movimentação lateral foca em atividade de pivô interno de host para host.

Pré-requisitos

• Logs de Segurança do Windows (EventCode 4624, 4625, 4648, 4672) de todos os endpoints e servidores.
• Sysmon implantado com criação de processos (EventCode 1), conexões de rede (EventCode 3) e named pipes (EventCode 17/18).
• Dados de fluxo de rede (NetFlow/sFlow, logs de conexão Zeek) para análise de tráfego interno.
• SIEM com capacidade de correlação entre fontes.
• Linha de base de padrões normais de autenticação interna.

Fluxo de Trabalho

Etapa 1: Detectar Pass-the-Hash / Pass-the-Ticket (T1550)

Detecção de Pass-the-Hash (EventCode 4624 com NTLM):

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
AuthenticationPackageName="NTLM"
| where TargetUserName!="ANONYMOUS LOGON" AND TargetUserName!="$"
| stats count, dc(ComputerName) AS unique_targets, values(ComputerName) AS targets
  by src_ip, TargetUserName
| where unique_targets > 3
| eval alert = "Possible Pass-the-Hash: NTLM network logon to ".unique_targets." hosts"
| sort - unique_targets
| table src_ip, TargetUserName, unique_targets, count, targets, alert

Detecção de Overpass-the-Hash (Kerberos com RC4):

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
TicketEncryptionType="0x17"
| where ServiceName!="krbtgt" AND ServiceName!="$"
| stats count, dc(ServiceName) AS unique_services by src_ip, TargetUserName
| where count > 5
| eval alert = "Possible Overpass-the-Hash: RC4 Kerberos tickets from ".src_ip
| table _time, src_ip, TargetUserName, unique_services, count, alert

Detecção de Golden/Silver Ticket (T1558):

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
| where TicketOptions="0x40810000" OR TicketOptions="0x40800000"
| eval ticket_lifetime = TicketExpireTime - TicketIssueTime
| where ticket_lifetime > 36000  --- >10 hours (abnormal)
| stats count by src_ip, TargetUserName, ServiceName, TicketEncryptionType, TicketOptions
| eval alert = "Possible Golden/Silver Ticket: Abnormal ticket properties"

Etapa 2: Detectar Exploração de Serviço Remoto (T1021)

Detecção de PsExec (T1021.002):

--- Via Sysmon process creation
index=sysmon EventCode=1
(Image="*\\psexec.exe" OR Image="*\\psexesvc.exe"
 OR OriginalFileName="psexec.c" OR OriginalFileName="psexesvc.exe"
 OR ParentImage="*\\psexesvc.exe")
| table _time, Computer, User, ParentImage, Image, CommandLine, Hashes

--- Via named pipe creation (Sysmon EventCode 17)
index=sysmon EventCode=17
PipeName IN ("\\PSEXESVC*", "\\RemCom*", "\\csexec*")
| table _time, Computer, User, Image, PipeName

--- Via Windows service creation (EventCode 7045)
index=wineventlog sourcetype="WinEventLog:System" EventCode=7045
ServiceName="PSEXESVC" OR ServiceFileName="*PSEXESVC*"
| table _time, Computer, ServiceName, ServiceFileName, AccountName

Execução Remota por WMI (T1047):

index=sysmon EventCode=1
(Image="*\\wmic.exe" AND CommandLine="*/node:*")
OR (ParentImage="*\\WmiPrvSE.exe" AND Image IN ("*\\cmd.exe", "*\\powershell.exe"))
| eval execution_type = case(
    match(Image, "wmic"), "WMI Command Line",
    match(ParentImage, "WmiPrvSE"), "WMI Provider Host (remote execution)"
  )
| table _time, Computer, User, execution_type, ParentImage, Image, CommandLine

Remoting WinRM/PowerShell (T1021.006):

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624
Logon_Type=3 AuthenticationPackageName="Kerberos"
| where ProcessName="*\\wsmprovhost.exe" OR ProcessName="*\\powershell.exe"
| stats count, dc(ComputerName) AS unique_targets by src_ip, TargetUserName
| where unique_targets > 2
| eval alert = "PowerShell Remoting to ".unique_targets." hosts from ".src_ip

--- Sysmon variant
index=sysmon EventCode=1
ParentImage="*\\wsmprovhost.exe"
Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\csc.exe")
| table _time, Computer, User, Image, CommandLine

Movimentação Lateral por RDP (T1021.001):

…