Stamus Labs | Lateral Movement Ruleset for Suricata

Suricata Ruleset for Windows Environments

Lateral movement is a technique that cyber attackers use to expand their network presence in search of sensitive data and high-value assets.

An open source project developed and supported by Stamus Networks, this Suricata ruleset is specifically focused on detecting lateral movement in Microsoft Windows environments.

What is the Lateral Movement Ruleset and what is included?

The ruleset currently includes nearly 500 Suricata detection signatures highlighting SMB/DCERPC-related network activities.

The ruleset provides another abstract hunting layer on top of the detected SMB/DCERPC events. A few examples of the detections include:

Remote creation of a net share
Remote creation of scheduled tasks
Remote creation of a service
Remote installation of a printer driver
DC enumeration

The ruleset is focused on highlighting and detecting Red Team or APT movements in windows SMB/DCERPC network environment.

Detection of remote configuration changes is possible due to Suricata’s recent SMB and DCERPC logging improvements which allow for easier alerting and provides more flexible detection. Remote configuration is not common in organizations and some of the operations are more often used by attackers than regular administrators.

Where to get the Ruleset

You may access the ruleset on the Stamus Labs threat intelligence server here:

LICENSE:

The "Lateral Movement Detection Ruleset for Suricata" from Stamus Labs is free threat intelligence: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3.0-or-later of the License.

Read the terms here >>

sha256: 02117e28def7125933848107499b14f672023d18513de4b21ad5422c6815f98a

Additional Resources

Open Ruleset for Detecting Lateral Movement in Windows Environments with Suricata

Threats! What Threats? Detecting Lateral Movement with Stamus Security Platform

Security Analyst's Guide to Suricata

Download

ABOUT STAMUS NETWORKS

Stamus Networks believes in a world where defenders are heroes, and a future where those they protect remain safe. As organizations face threats from well-funded adversaries, we relentlessly pursue solutions that make the defender’s job easier and more impactful. The global leader in Suricata-based network security solutions, Stamus Networks helps enterprise security teams know more, respond sooner and mitigate their risk with insights gathered from cloud and on-premise network activity. Our Stamus Security Platform combines the best of intrusion detection (IDS), network security monitoring (NSM), and network detection and response (NDR) systems into a single solution that exposes serious and imminent threats to critical assets and empowers rapid response.

Lateral Movement Ruleset for Suricata

Suricata Ruleset for Windows Environments

Be Part of the Conversation

What is the Lateral Movement Ruleset and what is included?

Where to get the Ruleset

Join the Community Discussion

Have questions or comments about the Lateral Movement Ruleset for Suricata project?
'

Join the discussion on our Discord server.

Additional Resources

Open Ruleset for Detecting Lateral Movement in Windows Environments with Suricata

Threats! What Threats? Detecting Lateral Movement with Stamus Security Platform

Security Analyst's Guide to Suricata

Lateral Movement Ruleset for Suricata

Suricata Ruleset for Windows Environments

Be Part of the Conversation

What is the Lateral Movement Ruleset and what is included?

Where to get the Ruleset

Join the Community Discussion

Have questions or comments about the Lateral Movement Ruleset for Suricata project?'

Join the discussion on our Discord server.

Additional Resources

Open Ruleset for Detecting Lateral Movement in Windows Environments with Suricata

Threats! What Threats? Detecting Lateral Movement with Stamus Security Platform

Security Analyst's Guide to Suricata

Have questions or comments about the Lateral Movement Ruleset for Suricata project?
'