Introduction
Even if you have implemented a Zero Trust security paradigm for network and infrastructure security, you need to plan for the inevitable — at some point, an attacker will get into your network with the intent to deploy ransomware or cause other damage
A typical attack goes something like this:
- A threat actor will compromise a user account through a phishing campaign, password-guessing attack or other technique, thereby gaining a foothold on an endpoint, IoT device or other system.
- They will move laterally through the environment and escalate their privileges until they gain access to vital IT resources. This stage can last weeks or even months as the attacker moves around studying your network.
- The attacker will exfiltrate sensitive data, deploy ransomware or other malware, and/or damage systems to cause downtime.
There is a misconception that lateral movement threats are limited to on-prem networks. But lateral movement can occur in cloud environments, and attackers can move laterally between on-prem and cloud systems.
It is up to cybersecurity personnel to detect threats, contain attacks to prevent further spread, and clean all infected systems. To defend your organization, you need to understand the techniques that threat actors utilize.
What are lateral movement and privilege escalation?
Threat actors typically gain a foothold in a network by compromising an account that has standard user privileges. To achieve their goal, the attacker must gain higher levels of access and control. According, when an attacker enters your environment, they begin to do reconnaissance to understand what resources they have access to and what accounts they may be able to compromise next. They may use network scanning tools to identify live hosts, open ports or running services within a targeted system platform. It is during this calm before the storm that detection and timely response are so important.
What specific techniques do attackers use?
Here are some of the more common techniques that attackers use to move laterally and escalate their privileges:
- LDAP reconnaissance — Threat actors can query an LDAP directory service to gather information about objects and attributes in order to identify highly privilege accounts and critical resources that they want to gain control over.
- Pass-the-Hash attack — This technique involves stealing a password of a user with elevated privileges by intercepting network traffic or using malware to extract the password hash.
- Kerberoasting — Adversaries can abuse the Kerberos authentication protocol to steal the credentials of Active Directory users that have servicePrincipleNames. More often than not, these accounts are service accounts, so they have higher levels of privilege than regular user accounts.
- Exploiting vulnerabilities — Hackers often exploit known vulnerabilities in systems or applications to elevate their privileges or gain access to additional systems. This type of attack takes advantage of unpatched or outdated software.
- Abusing weak configurations — Weak configurations on servers, endpoints and other systems enable adversaries to advance their attacks.
- Leveraging RDP — Remote administration tools such as the Remote Desktop Protocol (RDP) in Windows systems are often targeted by cyber criminals to move laterally within a network.
Hackers often utilize specialized tools designed for lateral movement, such as Bloodhound, PowerSploit or Empire. These are used to map out the network and identify potential targets for exploitation.
Real-World Examples
One highly publicized example of an attack featuring lateral movement was the SolarWinds supply chain attack of 2020. Threat actors gained access to SolarWinds software and inserted a backdoor into a software update. When customers installed that update, the attackers gained privileged access to their networks.
Another example that same year was a Ryuk ransomware attack on Universal Health Services. Here the perpetrators used a phishing email to deliver a trojan application, which then downloaded the ransomware. The cyber criminals then used Mimikatz to steal administrator credentials in order to move laterally across the network.
How Can Organizations Defend Themselves?
To help prevent adversaries from moving laterally in your IT environment, consider implementing the following best practices.
Restrict local administrator access.
Gone are the days in which you can assign local administrator rights to standard users. When an account is compromised, the attackers automatically inherit the rights of that account. Without local admin rights, attackers will be unable to install malicious code.
Enforce the principle of least privilege.
The principle of least privilege (POLP) states that each user and process should have access to only the network resources they need to perform their assigned job functions and nothing more. The initial understanding of POLP has evolved to include a temporal element — privilege should exist only as long it is needed for a certain task.
Cyber criminals often gain access to a target IT environment through a social engineering attack in which they manipulate a legitimate user into providing their credentials. This is where security awareness training can pay large dividends because users are often the weak links in your security chain. There are also email and web filtering solutions available to mitigate these types of attacks.
Protect your passwords.
Weak passwords make it easy for attackers to steal credentials using techniques such as password spraying attacks. There are tools that can help ensure that best-practice complexity standards are required for all passwords. You should support these policies with proper cyber hygiene training for all users. In addition, MFA should be applied to all high privilege accounts.
Replace standing privileged accounts with just-in-time access and monitor activity,
Administrative rights are the keys to the kingdom for a hacker. Implementing a solid privileged access management (PAM) strategy is essential to protecting privileged accounts from being compromised. One example is the Netwrix Privileged Access Management Solution, which empowers you to identify privileged accounts across your IT estate and reduce your attack surface by replacing them with just-in-time (JIT) access for completing specific tasks. Moreover, the solution gives you visibility into what privileged users are doing across your IT environment and alerts you to suspicious behavior.
Conclusion
Lateral movement is a common technique of attackers. Make sure you cut them off and contain them with the correct strategies, techniques and tools.
