Advanced Widespread Behavioral Probes against Lateral Movements
Alessandro Greco, Giovanni Pecoraro, Alberto Caponi, Giuseppe Bianchi · International Journal for Information Security Research · 2016
Once the attacker wants to copy a particular file, he can use the SMB functionalities to remote copy it with "copy \\IP\C$\PATH.".At traffic level, thus such operation can be detected looking for SMB ReadAndXRequest and hence the state transition can be modeled as follow: Transition from State#1 to State#1.e:Ev.A where: -EventA: SVCCTL ReadAndXReques (SVCCTL Command=" 0x2e") -Action: Pass to State 1