Analyzing Lateral Movement and Pivoting IOCs

Question 1

A technique to progressively move through a network to search for the key data
and assets that are ultimately the target of an attack campaign

Answer 1

Lateral Movement

Question 2

The use of one infected computer to attack a different computer
Pivoting uses the compromised system to attack other systems on the same
network to avoid restrictions such as firewall configurations
When an attacker uses a compromised host (the pivot) as a platform from which
to spread an attack to other points in the network

Answer 2

Pivoting

Question 3

A network-based attack where the attacker steals hashed user credentials and
uses them as-is to try to authenticate to the same network the hashed credentials
originated on

Answer 3

Pass the Hash

Question 4

An open-source application that allows users to view and save authentication
credentials in order to perform pass the hash attacks

Answer 4

Mimikatz

Question 5

While a pass the hash attack will work on local workstations, a Kerberos ticket is
needed in an Active Directory environment
A Kerberos ticket that can grant other tickets in an Active Directory environment
Golden tickets can grant administrative access to other domains members and
domain controllers

Answer 5

Golden Ticket

Question 6

The trust anchor of the Active Directory domain which functions like a private key
of a root certificate authority and generates ticket-granting tickets (TGT) that are
used by users to access services within Kerberos

Answer 6

krbtgt hash

Question 7

Any combination of hardware and software to enable the remote access tools or
information that typically reside on a network of IT devices

Answer 7

Remote Access Services

Question 8

Provides users with a terminal interface and enables administrators to run scripts
to manage those computers

Answer 8

Windows Management Instrumentation Command-Line (WMIC

Question 9

A tool developed as an alternative to Telnet and other remote access services
which utilizes the Windows SYSTEM account for privilege escalation

Answer 9

PsExec

Question 10

A task automation and configuration management framework from Microsoft,
consisting of a command-line shell and the associated scripting language

Answer 10

A tool developed as an alternative to Telnet and other remote access services
which utilizes the Windows SYSTEM account for privilege escalation