Lateral Movement

1. Purpose & Scope

• Purpose:

  This playbook defines the response workflow for suspected or confirmed lateral movement. It is used to identify how an attacker moved between systems, accounts, applications, cloud resources, or network segments; stop additional movement; preserve evidence; and coordinate recovery.

• Scope:

  Applies to lateral movement across endpoints, servers, Active Directory, identity providers, VPN, remote administration tooling, cloud workloads, cloud control planes, SaaS applications, and third-party access paths. This playbook should be executed alongside account takeover, privilege escalation, malware, ransomware, cloud compromise, or data exfiltration playbooks when those conditions are present.

2. Incident Identification & Criteria

Incident Type: Lateral Movement

Trigger Conditions:

Initiate this playbook when any of the following occur:

• Remote logon, RDP, SSH, SMB, WMI, WinRM, PsExec, or remote admin activity from an unusual source
• Same account authenticating to multiple systems in an abnormal pattern
• Privileged account use from a non-standard host or unexpected geography
• Administrative tooling, remote monitoring tooling, or dual-use tooling used without approval
• New service, scheduled task, remote command, or script execution on another host
• Cloud role chaining, cross-account access, workload identity pivoting, or cross-tenant access
• Malware, ransomware, or suspicious execution with propagation capability
• Shared credential, token, API key, or service account use across multiple assets

Severity Levels:

3. Roles & Responsibilities

• Incident Commander: Coordinates response, approves containment scope, sets severity, and owns escalation decisions.
• Incident Responder / Forensic Analyst: Reconstructs movement path, identifies affected assets/accounts, analyses remote execution, and preserves evidence.
• Communications Lead: Coordinates internal updates, affected-user communications, and executive messaging.
• Other Roles:
  • Identity & Access Team: Reviews authentication paths, privileged accounts, service accounts, sessions, MFA, and token abuse.
  • Endpoint / Infrastructure Team: Supports host isolation, segmentation, evidence collection, rebuild, and recovery validation.
  • Network Team: Restricts lateral protocols and validates segmentation controls.
  • Cloud Security / Platform Team: Reviews cloud role assumptions, workload pivots, and cloud containment actions.
  • Application / Service Owners: Validate whether observed administrative activity was authorised and support recovery.
  • Legal & Compliance: Engaged if movement resulted in data access, exfiltration, customer impact, or regulated system exposure.

4. Initial Actions

• Immediate Steps:

  • Validate the alert and identify the initial source, destination, account, protocol, tool, timestamp, and affected business service.
    • 📘 RB-TRIAGE-002: EDR Alert Triage
    • 📘 RB-TRIAGE-003: Identity Alert Triage
    • 📘 RB-TRIAGE-011: Cloud Platform Alert Triage
  • Determine whether movement is ongoing.
  • Engage infrastructure, identity, and service owners when containment may disrupt production.
    • 📘 SOP-001: Paging an Engineering Team's On-Call

  Decision Point:

  • If active movement is ongoing → isolate affected systems and restrict lateral protocols immediately.
  • If historical movement only → preserve evidence first, then proceed with scoped containment.

5. Investigation & Analysis

• Evidence Collection:

  • Collect endpoint process, command-line, service creation, scheduled task, authentication, VPN, network, cloud, and SaaS logs for each source and destination.
    • 📘 RB-EVIDENCE-002: Host-Based Log Acquisition
    • 📘 RB-EVIDENCE-003: Identity & Authentication Log Acquisition
    • 📘 RB-EVIDENCE-004: Cloud Control Plane Log Acquisition
  • Capture memory where credential theft, in-memory tooling, token theft, or active malware is suspected.
    • 📘 RB-EVIDENCE-001: Memory Acquisition

• Analysis Steps:

  • Identify patient zero, earliest suspicious activity, and the first confirmed movement event.
    • 📘 RB-ANALYSIS-003: Identify Patient Zero
  • Review authentication timelines, cross-system logons, shared credentials, MFA events, and session reuse.
    • 📘 RB-ANALYSIS-007: Authentication Log Analysis
  • Identify additional compromised accounts, shared indicators, and adjacent identities.
    • 📘 RB-ANALYSIS-011: Identify Additional Compromised Accounts
  • Assess privileged account exposure and administrative session hopping.
    • 📘 RB-ANALYSIS-009: Privileged Access Assessment
  • Analyse remote execution chains, command lines, LOLBins, and scripts used to move or execute on destination systems.
    • 📘 RB-ANALYSIS-006: Process Tree Analysis
    • 📘 RB-ANALYSIS-023: Command-Line Analysis
    • 📘 RB-ANALYSIS-024: LOLBin Abuse Investigation
    • 📘 RB-ANALYSIS-025: Script Execution Analysis
  • Validate whether the activity was approved administration, automation, deployment, or security testing.
    • 📘 RB-ANALYSIS-026: User Activity Validation
  • For cloud movement, review role assumptions, cross-account activity, resource changes, and persistence.
    • 📘 RB-ANALYSIS-043: Cloud Control Plane Activity Analysis
  • Build and maintain an affected asset inventory.
    • 📘 RB-ANALYSIS-035: Affected Asset Identification
  • Map observed techniques and identify detection gaps.
    • 📘 RB-ANALYSIS-005: Threat Actor TTP Mapping

  Decision Point: Run the post-detection phases (Analysis → Recovery) of any relevant sibling playbook concurrently alongside this one based on what was observed:

  • If privilege escalation is identified → execute PB-009: Privilege Escalation concurrently.
  • If malware or suspicious execution drove movement → execute PB-003: Endpoint Malware Infection or PB-011: Suspicious Execution concurrently.
  • If ransomware propagation is observed → execute PB-002: Ransomware concurrently.
  • If data access or staging occurred on destination systems → execute PB-005: Data Exfiltration concurrently.

6. Containment, Eradication & Recovery

• Containment Actions:

  • Isolate affected hosts and restrict remote administration protocols.
    • 📘 RB-CONTAIN-004: Host Isolation
  • Segment impacted networks and block lateral movement paths such as SMB, RDP, PsExec, WMI, WinRM, SSH, and remote admin shares.
    • 📘 RB-CONTAIN-002: Rapid Containment & Network Segmentation
  • Lock compromised accounts and revoke active sessions/tokens.
    • 📘 RB-CONTAIN-001: Account Lockdown
    • 📘 RB-CONTAIN-005: Session & Token Revocation
  • If Active Directory or privileged groups are affected, disable compromised domain accounts, remove unauthorised group memberships, block suspicious administrative sessions, and preserve domain controller evidence before making broad changes.
    • 📘 RB-CONTAIN-003: Active Directory Containment
  • Isolate affected cloud workloads where movement involved workload identities or cloud-hosted systems.
    • 📘 RB-CONTAIN-015: Cloud Workload Isolation

• Eradication Steps:

  • Remove malicious services, scheduled tasks, remote access tooling, scripts, accounts, credentials, access keys, and persistence mechanisms.
  • Rotate credentials and secrets used during movement, including shared local admin passwords, service account credentials, API keys, and cloud access keys.
  • Restore approved network, IAM, directory, and host configurations.

• Recovery Steps:

  • Rebuild systems where integrity is uncertain or persistence was identified.
    • 📘 RB-RECOVERY-002: Clean System Rebuild
  • Coordinate phased restoration and reintroduction of segmented systems.
    • 📘 RB-RECOVERY-001: Recovery & Restoration Coordination
  • Restore user access only after credential, token, and MFA containment is complete.
    • 📘 RB-RECOVERY-003: User Recovery & Access Restoration

  Decision Point: If new movement occurs after containment, expand scope, re-check privileged access, and return to Investigation & Analysis.

7. Communication & Escalation

• Internal Communication:

  • Notify security leadership, infrastructure owners, identity teams, affected service owners, and business stakeholders.
  • Use geo handoff where the incident spans response shifts.
    • 📘 SOP-002: Incident Handoff Between Geos
  • Notify affected users if account resets, MFA resets, or access restoration are required.
    • 📘 SOP-004: User Notification

• External Communication:

  • Engage Legal/Privacy if lateral movement reached customer data, regulated systems, partner environments, or externally hosted infrastructure.
    • 📘 SOP-003: Escalation, Legal & Executive Communications

• Escalation Criteria:

  Condition	Escalate To
  Privilege escalation identified	PB-009: Privilege Escalation
  Malware or suspicious execution identified	PB-003: Endpoint Malware Infection / PB-011: Suspicious Execution
  Ransomware propagation observed	PB-002: Ransomware
  Account compromise or token reuse identified	PB-004: Account Takeover
  Cloud movement or control plane abuse identified	PB-007: Cloud Compromise
  Data staging or exfiltration identified	PB-005: Data Exfiltration
  Enterprise-wide spread or critical infrastructure impact	PB-019: Major Security Incident Management

8. Post-Incident Activities

• Lessons Learned:

  • Conduct a Post-Incident Review (PIR)
  • Document what worked, what didn't, and what needs improvement

• Documentation Updates:

  • Update this playbook, detection logic, segmentation standards, remote administration controls, and linked runbooks where required.

9. References & Linked Resources

• Playbooks:

  • PB-002: Ransomware
  • PB-003: Endpoint Malware Infection
  • PB-004: Account Takeover
  • PB-005: Data Exfiltration
  • PB-007: Cloud Compromise
  • PB-009: Privilege Escalation
  • PB-011: Suspicious Execution
  • PB-019: Major Security Incident Management

• Runbooks:

  • RB-TRIAGE-002: EDR Alert Triage
  • RB-TRIAGE-003: Identity Alert Triage
  • RB-TRIAGE-011: Cloud Platform Alert Triage
  • RB-EVIDENCE-001: Memory Acquisition
  • RB-EVIDENCE-002: Host-Based Log Acquisition
  • RB-EVIDENCE-003: Identity & Authentication Log Acquisition
  • RB-EVIDENCE-004: Cloud Control Plane Log Acquisition
  • RB-ANALYSIS-003: Identify Patient Zero
  • RB-ANALYSIS-005: Threat Actor TTP Mapping
  • RB-ANALYSIS-007: Authentication Log Analysis
  • RB-ANALYSIS-009: Privileged Access Assessment
  • RB-ANALYSIS-011: Identify Additional Compromised Accounts
  • RB-ANALYSIS-023: Command-Line Analysis
  • RB-ANALYSIS-024: LOLBin Abuse Investigation
  • RB-ANALYSIS-025: Script Execution Analysis
  • RB-ANALYSIS-026: User Activity Validation
  • RB-ANALYSIS-035: Affected Asset Identification
  • RB-ANALYSIS-043: Cloud Control Plane Activity Analysis
  • RB-CONTAIN-001: Account Lockdown
  • RB-CONTAIN-002: Rapid Containment & Network Segmentation
  • RB-CONTAIN-003: Active Directory Containment
  • RB-CONTAIN-004: Host Isolation
  • RB-CONTAIN-005: Session & Token Revocation
  • RB-CONTAIN-015: Cloud Workload Isolation
  • RB-RECOVERY-001: Recovery & Restoration Coordination
  • RB-RECOVERY-002: Clean System Rebuild
  • RB-RECOVERY-003: User Recovery & Access Restoration
  • RB-POST-001: Ransomware Post-Incident Hardening

• SOPs:

  • SOP-001: Paging an Engineering Team's On-Call
  • SOP-002: Incident Handoff Between Geos
  • SOP-003: Escalation, Legal & Executive Communications
  • SOP-004: User Notification

10. Appendices

Contributor

Jayden Vo GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.