Lateral Movement
Last updated
Was this helpful?
Last updated
Was this helpful?
Most lateral movement techniques like PSexec, PSRemoting, DCOM, and WMIexec are detected only if it's "abnormal traffic." If these technologies are used often by the user, like help desk commonly RDPing to workstations to help fix technical problems, then it will be safe to use that as it is considered "normal behavior."
But, there are other more stealthy ways to move laterally apart from using those technologies.
Using only NTLM hashes to OPTH will be flagged by ATA as an encryption downgrade or unusual protocol implementation.
To generate kerberos tickets that will not be flagged, supply NTLM and AES keys and set the lifetime of the ticket to a normal value
Note that you can supply all zeroes for the aes128 key and it will not be flagged.
Moving laterally through SQL databases is not detected due to the fact that no traffic goes to the DC. All SQL authentication events are local to the server. We can find passwords and hashes of a privileged user, impersonate that user, and go on from there.
Using Kerberoasting and Silver Tickets are a good way to move laterally as Kerberoasting blends in with regular traffic and silver tickets have no communication with the DC whatsoever since its a forged TGS.
Make sure to slowly kerberoast users as kerberoasting all at once will cause spikes of traffic which may cause alerts.
We can slowly enumerate user objects with an SPN, by OU:
Then perform recon on groups that have access on various targets of interest:
And then kerberoast that target if applicable:
Beware of Honeypot SPNs, factor in last logon, creation date etc. to identify these types of accounts
If we successfully crack the hash, we can then create a silver ticket
If any of these sensitive groups are modified(like adding an account or changing passwords), These will be flagged for abnormal activity.
As a result, we can target other privileged groups like SQL admins or Help desk users.
The same logic applies to silver tickets to golden tickets as well, if we only supply the NTLM hash, it will be flagged as an encryption downgrade.
To subvert this, include all AES keys, note that if the length of the ticket is alive for more than 8 hours than its use, it is going to be flagged. So for extra stealthyness, create the ticket for like 20 minutes, use the ticket, and instantly destroy the ticket after:
