Seeing and stopping lateral movement
Internal segmentation, spotting tunnels and scans, and splitting the network fast during an incident.
Level 401 · 15 lessons · 12 practice labs
Lessons
Concept and network
- What lateral movement is and why it is dangerous: You will understand that lateral movement means someone inside a network moving from machine to machine, and why it makes a breach bigger.
- Internal network segmentation: You will learn how splitting the internal network into zones and limiting traffic between them slows the spread of a breach.
- Exposure of internal services: Redis and the like: You will understand the risk of internal services such as Redis sitting open on the network without authentication, and find and close them in your own lab network.
- Testing segmentation rules: measuring allowed and forbidden paths
- Short task: close the needless paths between two lab network segments
Detection
- Spotting SSH tunnels and proxy use: You will spot SSH tunnels and proxy use in connection records and process lists, and detect tunnels nobody expected.
- Restricting SSH forwarding: AllowTcpForwarding and PermitOpen: You will use sshd settings to limit, per user and destination, whether your servers can be used to tunnel into the internal network.
- Detecting scans inside the network: You will notice in network records when one internal machine behaves as if it is scanning the others, and set up an alert.
- Credential reuse and sideways privilege: You will see how reused passwords and broad privileges enable lateral movement, and learn measures that reduce it.
- Monitoring east-west traffic: You will monitor traffic between machines inside the network (east-west) and notice deviations from the normal pattern.
- Log traces of remote admin sessions: SSH, RDP and SMB
- Short task: pull the lateral movement traces in the lab out of the logs
Response
- Quickly splitting the network during an incident: You will plan the ready-made rules and steps for quickly cutting affected machines off the network during an incident.
- Splitting admin accounts into tiers
- Capstone: a network design that stops lateral movement: In the capstone you will design a network layout for a fictional company's flat network, with zones, monitoring and quick-isolation steps.
Practice labs
- Test segmentation rules: measure allowed and blocked paths: Write the expected access table between two segments and compare it with real connection tests.
- Close unnecessary paths between two segments: Close the forbidden paths found open with firewall rules and verify by repeating the tests.
- Find exposed internal services and narrow access: Find internal services like unauthenticated Redis, add authentication and network limits, and report.
- Restrict SSH forwarding: Apply AllowTcpForwarding and PermitOpen and confirm an unauthorised forwarding attempt is refused.
- Spot SSH tunnels and proxy use in logs: Find long-running forwarding sessions in SSH and connection logs and report their source.
- Set up and test a rule that detects internal scanning: Write a rule that catches one host contacting many hosts quickly in east-west traffic and test it on recorded traffic.
- Extract remote admin session traces from logs: Merge SSH, RDP and SMB session records into one table with source, target and account.
- Detect credential reuse and remove the shared password: Find the same local account logging in on many machines and replace the shared password with unique ones.
- Build a timeline of lateral movement traces in the lab: Order the machines hopped through in Karaçam Mobilya's lab network from logs and report the first and last steps.
- Quickly isolate the affected segment during an incident: Apply the prepared emergency rule and confirm the affected segment is reachable only from the response network.
- Split admin accounts into tiers: Create separate accounts for server and workstation admin, block cross-tier logons and verify.
- Apply and test a network layout that stops lateral movement: Apply segmentation, an admin jump host and monitoring rules together and show old paths are closed.
About this course
Internal segmentation, spotting tunnels and scans, and splitting the network fast during an incident.
What you will learn
- Concept and network
- Detection
- Response
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.