Chapter 33

Lateral Movement in Packets

Lateral movement leaves network traces: SMB connections, WMI traffic, RDP sessions, and PSExec/remote service installation — all visible in packet captures and network flow data. This chapter covers identifying each lateral movement technique from its network signature.

Scenario

Patient zero is FINANCE-SRV01. You have network captures for the internal subnet. The question: which other hosts did the attacker pivot to? A quick tshark summary of internal-to-internal SMB traffic shows an unusual pattern: FINANCE-SRV01 initiated SMB sessions to 7 other hosts between 03:00-04:00 UTC — at a time when finance staff aren't working. Each SMB session was followed by a service installation (port 445 traffic with IPC$ share access + service creation). The attacker used PSExec-style lateral movement to install their implant on 7 hosts in 60 minutes.

SMB Lateral Movement

  SMB-Based Lateral Movement Traffic Signatures
  ═══════════════════════════════════════════════════════════════════

  PSExec lateral movement (most common):
    1. TCP:445 connection from attacker host to target
    2. SMB2 Negotiate + Session Setup (with credentials)
    3. TreeConnect to \\TARGET\IPC$ and \\TARGET\ADMIN$
    4. Service creation via MS-SVCCTL RPC (installs PSEXECSVC)
    5. Service execution → remote shell/payload launched
    6. TCP:445 or named pipe (\\TARGET\pipe\PSEXECSVC)

  impacket smbexec/wmiexec:
    Similar to PSExec but uses \\TARGET\pipe\svcctl or WMI instead
    Named pipe connections visible in packet capture

  Token indicators:
    - SMB NTLMSSP Auth from unusual source host
    - IPC$ access followed immediately by service creation
    - %ADMIN$ tree connect (copying the service binary)
    - Multiple rapid SMB sessions to many targets (scanning behavior)
    - SMB auth failures before success (credential spraying)

Bashsmb-lateral-movement.sh

PCAP="/cases/CASE-2026-009/network/internal.pcap"

# Find all SMB connections (port 445)
tshark -r $PCAP -Y "tcp.dstport == 445 && tcp.flags.syn == 1" \
    -T fields -e frame.time -e ip.src -e ip.dst | \
    sort | uniq -c | sort -rn | head -30

# Find SMB auth with NTLMSSP — capture auth source + target
tshark -r $PCAP -Y "ntlmssp.auth.username" -T fields \
    -e frame.time -e ip.src -e ip.dst \
    -e ntlmssp.auth.domain -e ntlmssp.auth.username | \
    sort -k3 | head -40

# Find IPC$ tree connections (service control / lateral movement)
tshark -r $PCAP -Y 'smb2.tree contains "IPC$"' -T fields \
    -e frame.time -e ip.src -e ip.dst -e smb2.tree | \
    sort | head -30

# PSExec detection: ADMIN$ connect + IPC$ + service name
tshark -r $PCAP -Y 'smb2.tree contains "ADMIN$"' -T fields \
    -e frame.time -e ip.src -e ip.dst | head -20

# Detect service installation RPC (SVCCTL)
tshark -r $PCAP -Y "dcerpc.cn_bind_if contains 367abb81" -T fields \
    -e frame.time -e ip.src -e ip.dst
# UUID 367abb81-9844-35f1-ad32-98f038001003 = SVCCTL (service control manager)

WMI Lateral Movement

Bashwmi-traffic.sh

PCAP="/cases/CASE-2026-009/network/internal.pcap"

# WMI uses DCOM over port 135 (endpoint mapper) then dynamic high ports
# WMI lateral movement signature:
#   1. TCP:135 connection (DCOM endpoint mapper — get dynamic port)
#   2. Auth on port 135
#   3. Connection to dynamic port for actual WMI operations

# Step 1: Find DCOM endpoint mapper connections
tshark -r $PCAP -Y "tcp.dstport == 135 && tcp.flags.syn == 1" \
    -T fields -e frame.time -e ip.src -e ip.dst | head -20

# Step 2: Find WMI UUID (f309ad18 = IWbemServices)
tshark -r $PCAP -Y "dcerpc.cn_bind_if contains f309ad18" -T fields \
    -e frame.time -e ip.src -e ip.dst -e dcerpc.cn_bind_if | head -20

# Step 3: Follow the conversation — dynamic port connections from same src to same dst
# after the port 135 connection are likely WMI data channels

RDP Lateral Movement

Bashrdp-analysis.sh

PCAP="/cases/CASE-2026-009/network/internal.pcap"

# Find all RDP connections (TCP:3389)
tshark -r $PCAP -Y "tcp.dstport == 3389 && tcp.flags.syn == 1" \
    -T fields -e frame.time -e ip.src -e ip.dst | \
    sort | uniq -c | sort -rn

# RDP session timing — lateral movement sessions are often:
#   - Short (automated, not human-interactive)
#   - At unusual hours
#   - From a host that doesn't normally RDP to others

# Session duration analysis
tshark -r $PCAP -z conv,tcp \
    -Y "tcp.port == 3389" | \
    awk -F' ' '{print $1, $2, $3, "duration:", $8}' | head -30

# Look for RDP NLA auth failures (pre-auth errors visible in cleartext)
tshark -r $PCAP -Y "rdp.error_info" -T fields \
    -e frame.time -e ip.src -e ip.dst -e rdp.error_info | head -20

Lateral Movement Pattern Summary

Technique	Primary port(s)	Key network signature	Detection filter
PSExec	445	ADMIN$ TreeConnect → SVCCTL RPC service creation	`smb2.tree contains "ADMIN$"`
WMI	135 + dynamic	DCOM endpoint mapper → IWbemServices UUID on dynamic port	`tcp.dstport==135` followed by UUID search
RDP	3389	TLS session to port 3389; NTLMv2 auth visible	`tcp.dstport==3389`
WinRM / PSRemoting	5985/5986	HTTP/HTTPS to port 5985 (HTTP) or 5986 (HTTPS); SOAP/XML payloads	`tcp.dstport==5985 or tcp.dstport==5986`
Pass-the-Hash SMB	445	NTLMSSP auth with NTLM response (not Kerberos); unusual source host	`ntlmssp.auth.username` from unusual source
Pass-the-Ticket (Kerberos)	88 + 445	TGS-REQ from compromised host for service on target; then SMB conn	Kerberos ticket requests from unexpected hosts

Q & A

Q: You see lots of SMB traffic between internal hosts but aren't sure if it's legitimate (file sharing) or lateral movement. How do you distinguish them?

The key discriminators are: (1) Source host type: file servers making SMB connections to other servers = unusual. Workstations SMB-ing to servers = normal (accessing shares). Servers initiating SMB to other servers at 3am = suspicious. (2) Share path: legitimate file access targets named shares (e.g., \\server\finance). Lateral movement targets ADMIN$ (for file drop) or IPC$ (for RPC). Filter on smb2.tree contains "ADMIN$" or smb2.tree contains "IPC$" and investigate those. (3) Followed by service creation RPC: legitimate file access doesn't involve SVCCTL RPC calls. Service creation after SMB = PSExec-style execution. (4) Timing and breadth: legitimate file access is user-driven and varies in timing. Lateral movement tools rapidly hit multiple targets in a short window (seen as "fan-out" from one source to many destinations in 5-30 minutes). (5) Credential used: NTLMSSP auth with a high-privilege account (domain admin) on a connection from a low-privilege workstation = credential abuse, not normal file access.