{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/lateral-movement-detection-integration/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Elastic Defend (8.18 and above)","Lateral Movement Detection integration","Fleet","Kibana (min_stack_version 9.4.0)"],"_cs_severities":["low"],"_cs_tags":["lateral-movement","collection","data-exfiltration","machine-learning","anomaly-detection","elastic-defend"],"_cs_type":"advisory","_cs_vendors":["Elastic"],"content_html":"\u003cp\u003eThe Elastic machine learning rule, \u0026quot;Unusual Remote File Size\u0026quot;, identifies potential lateral movement or data exfiltration by flagging abnormally large file sizes transferred from remote hosts. Attackers often consolidate data into single large files to circumvent detection mechanisms that might trigger on multiple smaller transfers. This rule, part of the Lateral Movement Detection integration, leverages Elastic's Anomaly Detection feature to analyze file and Windows RDP process events, requiring the \u003ccode\u003ehost.ip\u003c/code\u003e field to be populated. For Elastic Defend versions 8.18 and above, explicit configuration is needed to enable host IP collection. The integration also requires the installation of preconfigured anomaly detection jobs within Fleet. This detection helps defenders identify suspicious network activity that could indicate an adversary moving within the network or preparing to exfiltrate data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eIf attackers successfully transfer unusually large files for lateral movement or data exfiltration, organizations face significant risks including the theft of sensitive information, establishment of further persistence within the network, and potential system compromise. The consolidation of data into large files allows adversaries to achieve their objectives with a higher likelihood of evading traditional security alerts. This could lead to severe data breaches, regulatory non-compliance fines, and substantial reputational damage for the affected entities.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable \u003ccode\u003ehost.ip\u003c/code\u003e field collection for Elastic Defend events, especially for versions 8.18 and above, by following Elastic's official configuration steps outlined in their helper guide.\u003c/li\u003e\n\u003cli\u003eInstall the Lateral Movement Detection integration assets in Kibana, ensuring all prerequisites are met and preconfigured anomaly detection jobs are added as described in the \u003ccode\u003esetup\u003c/code\u003e section.\u003c/li\u003e\n\u003cli\u003eReview the alert details for \u003ccode\u003eUnusual Remote File Size\u003c/code\u003e to identify specific remote hosts and file sizes involved in detected anomalies.\u003c/li\u003e\n\u003cli\u003eAnalyze network logs to trace the origin and destination of any suspicious large file transfers.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to limit lateral movement capabilities within the environment if a detected anomaly indicates malicious activity.\u003c/li\u003e\n\u003cli\u003eConduct thorough analysis of the contents and origin of unusually large file transfers to determine if sensitive data was involved and reset credentials for any associated compromised accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T18:08:45Z","date_published":"2026-07-28T18:07:58Z","id":"https://feed.craftedsignal.io/briefs/2026-07-unusual-remote-file-size/","summary":"An Elastic machine learning job detects unusually large file transfers by remote hosts, indicating potential lateral movement or data exfiltration by adversaries who consolidate data into single large files to avoid detection.","title":"Unusual Remote File Size Detected by ML","url":"https://feed.craftedsignal.io/briefs/2026-07-unusual-remote-file-size/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Elastic Defend","Data Exfiltration Detection integration","Fleet","Kibana","Windows RDP","Elastic Stack \u003e= 9.4.0","Lateral Movement Detection integration","Elastic Security","Sysmon Linux","Privileged Access Detection integration","Auditd Manager","Elastic Agent","System","Windows","Network Packet Capture","Fleet Server"],"_cs_severities":["low"],"_cs_tags":["exfiltration","machine-learning","elastic-defend","endpoint","lateral-movement","rdp","anomaly-detection","privilege-escalation","linux","behavioral-detection","elastic","discovery","reconnaissance","threat-detection","initial-access","credential-access","auditd-manager","host-based-detection","data-exfiltration","ddos","malware","system-compromise","elastic-security","anomaly_detection","network_denial","firewall","machine_learning","threat_detection","network-security","endpoint-security","command-and-control","persistence","network-anomaly","network-traffic-analysis","windows","ml","investigation-guide"],"_cs_type":"advisory","_cs_vendors":["Elastic","Microsoft"],"content_html":"\u003cp\u003eElastic has released a machine learning-based detection rule designed to identify potential data exfiltration attempts. This rule, part of the Data Exfiltration Detection integration, focuses on detecting unusual or rare processes that write data to external devices. Adversaries frequently use seemingly legitimate processes to mask their data exfiltration activities, making such abnormal behavior a strong indicator of compromise. The detection relies on Elastic's Anomaly Detection feature, analyzing network and file events collected via integrations like Elastic Defend and Network Packet Capture. This capability, available for Elastic Stack version 9.4.0 and higher, helps defenders identify deviations from typical process behavior, flagging potential threats where sensitive data might be transferred out of the network via an unapproved or suspicious channel.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker establishes initial access to a target system using various methods (e.g., phishing, exploiting a vulnerability).\u003c/li\u003e\n\u003cli\u003eThe attacker deploys or repurposes a benign-looking process on the compromised system.\u003c/li\u003e\n\u003cli\u003eSensitive data is identified and staged for exfiltration on the local system.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the seemingly legitimate process to write the staged sensitive data to an external device (e.g., USB drive, network share mapped as an external drive).\u003c/li\u003e\n\u003cli\u003eThe external device is removed, or the connection is terminated, completing the exfiltration of sensitive information.\u003c/li\u003e\n\u003cli\u003eThe unusual behavior of this rare process writing to an external device triggers an anomaly detection by Elastic's ML rule.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful data exfiltration can lead to severe consequences, including intellectual property theft, compromise of sensitive customer or employee data, regulatory fines due to data breaches, reputational damage, and financial losses. The targeted sectors are broad, as any organization handling valuable data is at risk. While the detection rule identifies a specific activity rather than a campaign, the impact of such exfiltration could range from minor data loss to a catastrophic breach depending on the volume and sensitivity of the data involved.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Data Exfiltration Detection integration and configure the machine learning job \u003ccode\u003eded_rare_process_writing_to_external_device_ea\u003c/code\u003e to leverage Elastic's anomaly detection capabilities.\u003c/li\u003e\n\u003cli\u003eEnsure Elastic Defend is fully installed and collecting file events on all endpoints, as indicated in the setup instructions.\u003c/li\u003e\n\u003cli\u003eWhen an alert is triggered, investigate the \u003ccode\u003eprocess name\u003c/code\u003e, \u003ccode\u003epath\u003c/code\u003e, and associated \u003ccode\u003euser account\u003c/code\u003e to determine if the activity is legitimate, as suggested in the investigation guide.\u003c/li\u003e\n\u003cli\u003eReview the \u003ccode\u003eexternal device's details\u003c/code\u003e and the \u003ccode\u003evolume and type of data\u003c/code\u003e being written to identify any sensitive or unusual transfers.\u003c/li\u003e\n\u003cli\u003eUse the provided \u0026quot;Investigation Guide\u0026quot; within the rule's note to systematically triage and analyze alerts generated by this rule.\u003c/li\u003e\n\u003cli\u003eCreate allowlists for legitimate backup processes, data transfer applications, software updates, and IT maintenance activities to reduce false positives, as mentioned in the \u0026quot;False positive analysis\u0026quot; section.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T18:42:21Z","date_published":"2026-07-28T18:05:39Z","id":"https://feed.craftedsignal.io/briefs/2026-07-unusual-process-external-device/","summary":"Elastic's Data Exfiltration Detection integration leverages machine learning to identify rare processes writing data to external devices, indicating potential data exfiltration by adversaries using benign-looking processes.","title":"Unusual Process Writing Data to an External Device Detected by Machine Learning","url":"https://feed.craftedsignal.io/briefs/2026-07-unusual-process-external-device/"}],"language":"en","title":"CraftedSignal Threat Feed - Lateral Movement Detection Integration","version":"https://jsonfeed.org/version/1.1"}