3.1.2. Investigating Multi-Stage and Lateral Movement Attacks

💡 First Principle: Attackers rarely stay where they started. They enter through one door (a phish, a password spray), steal credentials, and move to more valuable systems. Investigating a multi-stage attack means reconstructing that path in order, because containment that stops at the entry point leaves the attacker active wherever they went next.

Multi-stage attacks progress through ATT&CK tactics over time; multi-domain attacks cross product boundaries (email to identity to endpoint to cloud); lateral movement is the technique of using stolen credentials or remote execution to hop between hosts. A typical story looks like this:

The Defender XDR incident gives you three views of this story. The attack story shows alerts on a timeline with an incident graph linking entities (users, devices, IPs, files, mailboxes), so you can see which device the stolen account touched next. The alerts list shows each detection with its source product and MITRE tactic, which helps order the stages. The assets tab lists every affected device, user, mailbox, and app, which becomes your containment checklist.

Lateral movement has dedicated tools. Defender for Identity's lateral movement paths on a user or device page show how an attacker could reach sensitive accounts from a compromised machine through cached credentials and local admin rights, which tells you where to look next and which accounts to protect first. Advanced hunting extends the search beyond the incident: logons by the compromised account (IdentityLogonEvents, DeviceLogonEvents), remote execution tools (DeviceProcessEvents for PsExec or WMI), and new connections from the affected device (DeviceNetworkEvents) reveal hops that correlation didn't catch.

Response follows the story in reverse priority: contain the most dangerous current position first (the device encrypting files, the domain-privileged account), then the earlier footholds, then close the entry point (purge the phish, revoke sessions, remove the inbox rule). Containing only the patient-zero laptop while the attacker holds a domain admin session elsewhere ends nothing.

⚠️ Exam Trap: When an incident shows credential theft on one device and suspicious logons on others, the next step is to scope the compromised identity's activity (identity logons, lateral movement paths, hunting) before declaring containment complete. Isolating only the first device is the classic incomplete answer.

Reflection Question: Why does a compromised user account often matter more for containment than the device where the compromise began? Which actions in which products address each?