Suspected Lateral Movement from Compromised Host

  1[metadata]
  2creation_date = "2025/12/31"
  3maturity = "production"
  4updated_date = "2026/09/18"
  5
  6[rule]
  7author = ["Elastic"]
  8description = """
  9Detects potential lateral movement or post-compromise activity by correlating alerts where the host.ip of one alert matches
 10the source.ip of a subsequent alert. This behavior may indicate a compromised host being used to authenticate to another system
 11or resource, including cloud services.
 12"""
 13from = "now-30m"
 14interval = "29m"
 15language = "esql"
 16license = "Elastic License v2"
 17name = "Suspected Lateral Movement from Compromised Host"
 18risk_score = 73
 19rule_id = "171a4981-9c1a-4a03-9028-21cff4b27b38"
 20setup = """## Setup
 21
 22This rule requires the `host.ip` field to be populated.
 23For **Elastic Defend** events on versions **8.18 and above**, this field is **disabled by default**.
 24
 25If you are using **Elastic Defend**, ensure host IP collection is enabled by following the configuration steps in the
 26[helper guide](https://www.elastic.co/docs/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint#host-fields).
 27"""
 28severity = "high"
 29tags = [
 30    "Use Case: Threat Detection",
 31    "Rule Type: Higher-Order Rule",
 32    "Resources: Investigation Guide",
 33    "Noise: Medium",
 34    "Performance: Normal",
 35    "Rule Type: ES|QL",
 36    "Domain: Endpoint",
 37]
 38timestamp_override = "event.ingested"
 39type = "esql"
 40
 41query = '''
 42from .alerts-security.*
 43
 44// any alerts excluding deprecated, low severity and threat_match rules
 45| where kibana.alert.rule.name is not null and kibana.alert.risk_score > 21 and
 46        kibana.alert.rule.type != "threat_match" and
 47        not kibana.alert.rule.name like "Deprecated - *" and
 48        not KQL("""kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """) and
 49        not kibana.alert.rule.name in ("Abnormally Large DNS Response", "Web Application Suspicious Activity: No User Agent")
 50
 51// alerts with existing source.ip or host.ip
 52| eval alert_source_ip = CASE(source.ip is not null, source.ip, null),
 53       alert_host_ip = CASE(host.ip is not null and source.ip is null, host.ip, null)
 54
 55| eval Esql.source_ip = COALESCE(alert_source_ip, alert_host_ip)
 56| where Esql.source_ip is not null and Esql.source_ip != "127.0.0.1" and Esql.source_ip != "::1"
 57
 58| stats Esql.alerts_count = COUNT(*),
 59        Esql.event_module_distinct_count = COUNT_DISTINCT(event.module),
 60        Esql.host_id_distinct_count = COUNT_DISTINCT(host.id),
 61        Esql.rule_name_distinct_count = COUNT_DISTINCT(kibana.alert.rule.name),
 62        Esql.event_module_values = VALUES(event.module),
 63        Esql.message_values = VALUES(message),
 64        Esql.rule_name = VALUES(kibana.alert.rule.name),
 65        Esql.event_action_values = VALUES(event.action),
 66        Esql.event_category_values = VALUES(event.category),
 67        Esql.process_executable_values = VALUES(process.executable),
 68        Esql.process_cmdline_values = VALUES(process.command_line),
 69        Esql.file_path_values = VALUES(file.path),
 70        Esql.host_id_values = VALUES(host.id),
 71        Esql.host_ip_values = VALUES(host.ip),
 72        Esql.destination_ip_values = VALUES(destination.ip),
 73        Esql.user_name_values = VALUES(user.name),
 74        SRC_IP = VALUES(source.ip)
 75        by Esql.source_ip
 76
 77// filter for different alerts from multiple hosts and where the host.ip of one alert matches the source.ip of the other alert
 78| eval concat_ip_values = MV_CONCAT(TO_STRING(Esql.host_ip_values), ",")
 79| eval host_ip_equal_to_source_ip =LOCATE(concat_ip_values, TO_STRING(Esql.source_ip))
 80| where Esql.rule_name_distinct_count >= 2 and Esql.host_id_distinct_count >= 2 and host_ip_equal_to_source_ip > 0 and SRC_IP is not null and Esql.alerts_count <= 100
 81
 82// Move single values to their corresponding ECS fields for alerts exclusion
 83| eval source.ip = mv_min(Esql.source_ip),
 84       host.id = mv_min(Esql.host_id_values)
 85| KEEP Esql.*, source.ip, host.id
 86'''
 87note = """## Triage and analysis
 88
 89> **Disclaimer**:
 90> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 91
 92### Investigating Suspected Lateral Movement from Compromised Host
 93
 94The detection rule uses alert data to determine when multiple alerts from different integrations involving the same user.name are triggered.
 95
 96### Possible investigation steps
 97
 98- Review the alert details to identify the specific host involved and the different modules and rules that triggered the alert.
 99- Examine the timeline of the alerts to understand the sequence of events and determine if there is a pattern or progression in the tactics used.
100- Correlate the alert data with other logs and telemetry from the host, such as process creation, network connections, and file modifications, to gather additional context.
101- Investigate any known vulnerabilities or misconfigurations on the host that could have been exploited by the adversary.
102- Check for any indicators of compromise (IOCs) associated with the alerts, such as suspicious IP addresses, domains, or file hashes, and search for these across the network.
103- Assess the impact and scope of the potential compromise by determining if other hosts or systems have similar alerts or related activity.
104
105### False positive analysis
106
107- Vulnerability scanners.
108- Jump hosts, NAT gateways and proxies.
109
110### Response and remediation
111
112- Isolate the affected host from the network immediately to prevent further lateral movement by the adversary.
113- Conduct a thorough forensic analysis of the host to identify the specific vulnerabilities exploited and gather evidence of the attack phases involved.
114- Remove any identified malicious software or unauthorized access tools from the host, ensuring all persistence mechanisms are eradicated.
115- Apply security patches and updates to the host to address any exploited vulnerabilities and prevent similar attacks.
116- Restore the host from a known good backup if necessary, ensuring that the backup is free from compromise.
117- Monitor the host and network for any signs of re-infection or further suspicious activity, using enhanced logging and alerting based on the identified attack patterns.
118- Escalate the incident to the appropriate internal or external cybersecurity teams for further investigation and potential legal action if the attack is part of a larger campaign."""