SDF-LR05

Lateral Movement Channels

advancedDetection Value: highCost: lowTime: 3-7 days🖥 Endpoint Systems

Description

Create apparent lateral movement opportunities that guide adversaries from compromised production systems toward deception infrastructure. This includes trust relationships, network shares, and remote access paths that exist solely to redirect adversary lateral movement.

Rationale

Once adversaries gain initial access, they immediately look for ways to move laterally. By creating paths that are slightly easier or more attractive than paths to actual crown jewels, you can redirect adversary movement toward deception infrastructure where their activity is fully observable.

Supporting Basis

Literature-informed design

Honeynets and interspersed decoys support movement through a deceptive environment, while the named channel-engineering record is a ShadowMatrix formulation.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Map production trust relationships

Document existing trust relationships, remote access paths, and service account permissions that facilitate legitimate lateral movement.

Create parallel deception paths

Establish trust relationships and access paths that mirror production patterns but point toward deception infrastructure.

Calibrate path attractiveness

Make deception paths slightly more attractive than production paths: slightly weaker authentication, slightly more permissive ACLs, or slightly more visible service advertisements.

Monitor path traversal

Instrument all deception lateral movement paths to detect and alert on any traversal.

Technical Implementation Examples(1)

Active Directory Lateral Movement Paths

Create AD trust relationships and group memberships that guide adversaries toward deception infrastructure

powershell

# Create-DeceptionLateralPaths.ps1
# Configure AD objects that create discoverable paths to deception hosts.
# When adversaries run BloodHound or ADRecon, these paths appear.

Import-Module ActiveDirectory

# 1. Create a group that has "admin" rights on deception hosts
# (BloodHound will show this as a lateral movement path)
New-ADGroup -Name "DB-Server-Admins" `
    -GroupScope DomainLocal `
    -GroupCategory Security `
    -Path "OU=Groups,OU=Corporate,DC=corp,DC=internal" `
    -Description "Database server local administrators"

# Add decoy accounts to the group (makes them look privileged)
Add-ADGroupMember -Identity "DB-Server-Admins" `
    -Members @("r.nakamura", "svc_sql_backup")

# 2. Create a GPO that grants this group local admin on decoy hosts
# (This makes the path visible in BloodHound attack graphs)
# In production, use: New-GPO and Set-GPPermission
Write-Host "[*] Create GPO 'DB Server Access' granting" `
    "DB-Server-Admins local admin on OU=DatabaseServers" -Fore Cyan

# 3. Add a computer object for decoy hosts in the correct OU
New-ADComputer -Name "PROD-DB-04" `
    -SamAccountName "PROD-DB-04$" `
    -Path "OU=DatabaseServers,OU=Servers,DC=corp,DC=internal" `
    -Description "PostgreSQL Primary - Customer DB" `
    -OperatingSystem "Ubuntu 22.04 LTS" `
    -OperatingSystemVersion "22.04"

# 4. Create a managed service account for the decoy DB
# (Kerberoastable if adversary discovers the SPN)
Set-ADUser -Identity "svc_sql_backup" `
    -ServicePrincipalNames @{
        Add="MSSQLSvc/prod-db-04.corp.internal:1433"
    }

Write-Host "[+] Lateral movement paths configured:" -Fore Green
Write-Host "    Path 1: Any user -> r.nakamura creds -> " `
    "DB-Server-Admins -> PROD-DB-04 (decoy)" -Fore Yellow
Write-Host "    Path 2: Kerberoast svc_sql_backup -> " `
    "PROD-DB-04 (decoy)" -Fore Yellow
Write-Host ""
Write-Host "[!] These paths will appear in BloodHound scans" -Fore Cyan

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1021Remote Services	Lateral Movement	detects
T1080Taint Shared Content	Lateral Movement	detects

Considerations

The balance between attractiveness and subtlety is critical. Deception paths that are obviously easier than production paths will arouse suspicion.
Consider the adversary perspective at each step. After compromising a workstation, what does BloodHound show? What does a network scan reveal? The deception paths should appear in these results.
Lateral movement channels must be monitored end-to-end. An adversary traversing a deception path who then pivots to production represents a containment failure.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

Tools & Resources

Active Directory configuration
Network ACL management
Trust relationship management tools

Related Techniques

SDF-LR03Credential Breadcrumb Trails

SDF-LR02Network Path Engineering

Quick Stats

Phase: Lure
Difficulty: advanced
Detection Value: high
Cost: low
Time: 3-7 days
ATT&CK Mappings: 2