Ir Playbook Lateral Movement

IR Playbook — Lateral Movement

Severity critical: lateral movement means an adversary already has a foothold and valid credentials. Correlate across hosts before containment. Rule IDs are from the stock Wazuh 4.14 ruleset (levels official); several need Sysmon or PowerShell script-block logging on the endpoints. Full procedure: references/playbook.md.

1. Detection signals

High-confidence patterns: one account authenticating to ≥3 hosts within 10 min; workstation-to-workstation admin logons; service accounts used interactively; logons outside the account's baseline. Wazuh has no stock rule for the fan-out pattern — create it as custom rule 100230 (frequency rule over group authentication_success, <same_field>dstuser</same_field>, <different_field>agent.id</different_field>; validate with wazuh-logtest). Explicit-credential logons (Event ID 4648) have no stock rule either; add custom rule 100231 if you rely on them.

2. Triage / investigation (investigation agent)

1. Scope: search_security_events for the account and the source host across all agents (time_range: "24h", then "7d"); get_wazuh_alerts with rule_groups: ["authentication_success","sysmon_eid3_detections","sysmon_eid1_detections"] on each suspected host. search_cases for the host/account first.
2. Answer:
   • Which account, which source host? Admin jump host (expected) or workstation?
   • How many destinations, over what window? Any domain controllers or crown-jewel servers?
   • Which technique (SMB, WinRM, RDP, WMI, PsExec, SSH)?
   • Initial compromise on the source (phishing, brute force, malware)? If brute force → ir-playbook-bruteforce.
3. On each touched host (DCs and servers first):
   • get_agent_processes: psexesvc, wmiprvse children, wsmprovhost, unusual powershell, credential tools.
   • get_agent_ports: new listeners, RDP/WinRM exposure, outbound C2.
   • check_agent_health: agents stopped or tampered with during the spread.
   • Hand off to threat-intel for hashes/external C2 reputation.
4. add_entities (account = compromised, source host, each destination host with agent_id), link_mitre, update_case severity critical unless proven sanctioned (change ticket, jump host, known admin).
5. add_finding: host-hop timeline, compromised accounts, confirmed/suspected hosts, first hop time, and a containment recommendation to response-planner.

3. Response (response-planner)

Check current state first (wazuh_check_agent_isolation, wazuh_check_user_status), then propose:

Sequencing: isolate the source before killing processes; disable accounts after isolation so the attacker can't pivot during the change; never isolate domain controllers without a human decision (keep DCs in protected targets). Domain-level account disable, krbtgt reset and GPO changes are human tasks — add_finding with owner and urgency.

4. Eradication and recovery

• Reset credentials for every account in the chain (krbtgt twice if Kerberos abuse is suspected).
• Remove persistence created during movement (services, scheduled tasks, WMI subscriptions — rules 89501, 89502 flag WMI consumers).
• Rebuild or clean isolated hosts; un-isolation is a human-approved rollback in the approvals UI.
• Tighten: LAPS, tiered admin model, block workstation-to-workstation SMB/RDP, restrict WinRM.

5. Verification

The responder verifies each executed action (wazuh_check_agent_isolation, wazuh_check_user_status, wazuh_check_process) and records verification findings.

6. Evidence and records

• Findings with standard_refs such as MITRE-ATTACK:T1021.002, MITRE-ATTACK:T1550.002, NIST-800-61r3:Respond.
• Preserve references to Event IDs 4624, 4648, 4672, 7045 and 4698 before hosts are reimaged.
• Coverage gaps (no Sysmon, no script-block logging, no fan-out rule) → hand off to detection-engineer.
• Hand off to reporting for the incident report with blast radius and credential-reset status.

Escalation