mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-31 08:17:42 +03:00
123 lines
4.3 KiB
Markdown
123 lines
4.3 KiB
Markdown
# Lateral Movement Investigation Checklist
|
|
|
|
## Incident Details
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| **Incident ID** | |
|
|
| **Date/Time Detected** | |
|
|
| **Analyst** | |
|
|
| **Detection Source** | Zeek — lateral movement detection |
|
|
| **Severity** | ☐ Critical ☐ High ☐ Medium ☐ Low |
|
|
|
|
## Initial Triage
|
|
|
|
- [ ] Review Zeek notice.log for lateral movement alerts
|
|
- [ ] Identify the suspected source host (patient zero)
|
|
- [ ] Determine the timeframe of suspicious activity
|
|
- [ ] Check if activity correlates with known maintenance/change windows
|
|
- [ ] Verify source host is not a known admin workstation
|
|
|
|
## SMB Admin Share Analysis (T1021.002)
|
|
|
|
- [ ] Query `smb_mapping.log` for admin share access (`C$`, `ADMIN$`, `IPC$`)
|
|
```bash
|
|
cat smb_mapping.log | zeek-cut ts id.orig_h id.resp_h path | grep -iE '(ADMIN\$|C\$|IPC\$)'
|
|
```
|
|
- [ ] Identify the user account used for SMB authentication
|
|
- [ ] Check `dce_rpc.log` for `svcctl` service creation (PsExec indicator)
|
|
```bash
|
|
cat dce_rpc.log | zeek-cut ts id.orig_h id.resp_h endpoint operation | grep -i svcctl
|
|
```
|
|
- [ ] List all hosts accessed via admin shares from the source
|
|
- [ ] Document share paths and timestamps
|
|
|
|
## RDP Pivot Analysis (T1021.001)
|
|
|
|
- [ ] Query `conn.log` for internal RDP connections
|
|
```bash
|
|
cat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration | awk '$4 == 3389'
|
|
```
|
|
- [ ] Identify hosts acting as both RDP client and server (pivot nodes)
|
|
- [ ] Map the full RDP pivot chain
|
|
- [ ] Check RDP session durations for anomalies
|
|
- [ ] Verify if RDP is authorized for identified hosts
|
|
|
|
## Pass-the-Hash Analysis (T1550.002)
|
|
|
|
- [ ] Query `ntlm.log` for multi-source authentication per user
|
|
```bash
|
|
cat ntlm.log | zeek-cut ts id.orig_h username domainname success | sort -k3
|
|
```
|
|
- [ ] Identify accounts authenticating from 3+ distinct sources
|
|
- [ ] Check if flagged accounts are service accounts (expected multi-source)
|
|
- [ ] Determine if source hosts are authorized for the flagged accounts
|
|
- [ ] Cross-reference with Active Directory logon events
|
|
|
|
## DCSync Analysis (T1003.006)
|
|
|
|
- [ ] Query `dce_rpc.log` for `drsuapi` endpoint calls
|
|
```bash
|
|
cat dce_rpc.log | zeek-cut ts id.orig_h id.resp_h endpoint operation | grep -i drsuapi
|
|
```
|
|
- [ ] Verify if source hosts are legitimate domain controllers
|
|
- [ ] If non-DC source detected: **ESCALATE IMMEDIATELY**
|
|
- [ ] Document source IP, destination DC, and timestamp
|
|
- [ ] Check if krbtgt or privileged accounts may be compromised
|
|
|
|
## Lateral Tool Transfer Analysis (T1570)
|
|
|
|
- [ ] Query `files.log` for executable transfers between internal hosts
|
|
```bash
|
|
cat files.log | zeek-cut ts tx_hosts rx_hosts filename mime_type total_bytes | \
|
|
grep -E 'x-dosexec|x-executable'
|
|
```
|
|
- [ ] Identify transferred filenames and sizes
|
|
- [ ] Extract file hashes from `files.log` for threat intelligence lookup
|
|
- [ ] Check if files were subsequently executed (correlate with endpoint logs)
|
|
|
|
## Scope Assessment
|
|
|
|
- [ ] Total number of affected hosts: ____
|
|
- [ ] Total number of compromised accounts: ____
|
|
- [ ] Earliest indicator timestamp: ____
|
|
- [ ] Latest indicator timestamp: ____
|
|
- [ ] Network segments affected: ____
|
|
- [ ] Any evidence of data exfiltration: ☐ Yes ☐ No ☐ Unknown
|
|
|
|
## Evidence Collection
|
|
|
|
- [ ] Preserve relevant Zeek logs (copy, do not modify originals)
|
|
- [ ] Capture full PCAPs for key timeframes if available
|
|
- [ ] Export timeline from `scripts/process.py` output
|
|
- [ ] Screenshot/export SIEM correlation results
|
|
- [ ] Document chain of custody
|
|
|
|
## Containment Actions
|
|
|
|
- [ ] Isolate confirmed compromised hosts from network
|
|
- [ ] Disable compromised user accounts
|
|
- [ ] Block lateral movement paths (firewall rules)
|
|
- [ ] If DCSync detected: initiate credential rotation
|
|
- [ ] If PtH detected: force password reset for affected accounts
|
|
- [ ] Restrict RDP access to authorized admin workstations only
|
|
|
|
## Post-Incident
|
|
|
|
- [ ] Update Zeek detection thresholds based on findings
|
|
- [ ] Add legitimate admin share usage to allowlists
|
|
- [ ] Document lessons learned
|
|
- [ ] Update incident response playbook
|
|
- [ ] Schedule follow-up threat hunt in 30 days
|
|
- [ ] Brief stakeholders on findings and remediation
|
|
|
|
## Notes
|
|
|
|
_Use this space for free-form investigation notes, timeline reconstruction, and analyst observations._
|
|
|
|
---
|
|
|
|
**Template version:** 1.0
|
|
**Last updated:** 2025-03-17
|
|
**MITRE ATT&CK references:** TA0008, T1021.001, T1021.002, T1550.002, T1570, T1003.006
|