Detection of Potential Lateral Movement via Alert Correlation

This detection rule provides a higher-order analytical approach to identify lateral movement by correlating disparate security alerts across an enterprise network. Instead of focusing on single atomic events, the rule logic aggregates alerts where the host.ip of one host correlates with the source.ip of alerts originating from a separate host. This pattern suggests an adversary is using a compromised endpoint as a pivot point to conduct further reconnaissance or access additional systems within the environment. The rule filters out low-severity events and specific noise-prone alerts to maintain a high signal-to-noise ratio, effectively acting as an automated threat hunting mechanism to surface cross-host infection chains.

Impact

Successful lateral movement allows adversaries to navigate an internal network, elevate privileges, and reach high-value assets such as domain controllers, sensitive file shares, or cloud service configuration interfaces. If left undetected, this phase of an attack often precedes ransomware deployment, large-scale data exfiltration, or long-term persistence in the target network.

Recommendation

Prioritized actions for detection and response teams:

• Deploy the higher-order detection logic to identify cross-host alert correlation patterns indicating potential pivots.
• Enable host.ip collection for all endpoints, specifically ensuring Elastic Defend versions 8.18 and above are configured to populate this field as required for the logic.
• Review the list of triggered alerts to isolate the patient-zero host; perform network isolation immediately upon confirming lateral movement indicators.
• Investigate the specific user accounts associated with the source and destination alerts to determine if credentials were compromised or if non-interactive service accounts are being abused.
• Tune the detection logic to account for known network architecture artifacts, such as NAT gateways, proxies, or jump hosts, which may generate frequent cross-host alert patterns.