Lateral movement: what it looks like from inside a decoy

Lateral movement is the part of an attack that happens after the initial compromise and before the final payload. It is the attacker moving from the first foothold — a laptop, a cloud credential — toward the systems they actually want: domain controllers, databases, backup servers, source code repositories.

Why it is hard to detect on real systems

Lateral movement looks a lot like normal work. Admins log in to many machines. Service accounts query databases. Developers pull from source control. An attacker doing the same things blends in, and alert rules tuned tightly enough to catch an attacker will also fire on your administrators a dozen times a day.

The industry answer is UEBA — user and entity behaviour analytics — which builds baselines and alerts on deviations. It works, but it requires weeks of training data, careful tuning, and produces enough false positives that most security teams learn to ignore the low-severity ones.

What a decoy sees that UEBA misses

A decoy doesn't need a baseline. It sits in the path an attacker is likely to travel — next to your real file server, at the IP of a decommissioned host, in the segment your backup jobs live in — and it just waits. Whoever touches it shouldn't be there.

In practice, lateral movement events on Kandaro sensors look like this: an SMB session from an internal IP, trying to authenticate with credentials that look like a service account or a domain admin hash. Sometimes it is Pass-the-Hash (the attacker is using a stolen NTLM hash rather than a plain password). Sometimes it is a valid credential they found in a config file on the compromised machine.

The 20-minute window

In incidents where decoys catch lateral movement, the gap between the initial event and a credentialed login attempt is usually under 20 minutes. The attacker has already run their reconnaisance and they know what they found.

The decoy catches them at the moment they pivot. That is early enough to disconnect the source before they reach your real systems. Kandaro tells you the source IP, the username they tried, and what to do next: disconnect the machine, reset the credential.

Read about why backup servers are a favourite lateral movement target, or try deploying your first decoy.