Credential Access & Lateral Movement
How one foothold becomes a domain compromise, LSASS dumping, Kerberoasting, and PsExec, plus the detections that actually catch each.
Most breaches are not one clever exploit, they are a stolen credential used to walk from a single workstation to the domain controller. This is the stage where detection pays off most.
- T1003.001LSASS memory dumping
Attackers read LSASS to harvest passwords and Kerberos tickets. Detect on suspicious handle access to lsass.exe (Sysmon EID 10) and enable Credential Guard.
- T1558.003Kerberoasting
Service tickets for SPN accounts are requested and cracked offline. Watch for anomalous TGS requests and weak service-account passwords.
- T1021.002SMB / Admin Shares
Credentials are used to run code on remote hosts over ADMIN$ / C$. Detect remote service creation and unusual admin-share writes.
The gap everyone has
Lateral movement over SMB frequently produces telemetry (Sysmon EID 1, service events) that is collected but not alerted on. The fix is a correlation rule, and, crucially, exercising it against real PsExec-style movement so you know it fires before an incident proves it doesn't.
Stop reading. Start detecting.
Try the interactive kill chain in your browser, no signup, then run the real range.
Next module
Building a Purple Team Program