Complex Attacks & Lateral Movement

What makes an attack “complex”?

The attack chain

Most complex attacks follow a predictable pattern:

Stage	What Happens	Where to Look
1. Initial access	Phishing email, exploited vulnerability, stolen credentials	Defender for Office 365, Entra ID sign-in logs
2. Execution	Malware runs, script executes, tool downloads	Defender for Endpoint (DeviceProcessEvents)
3. Persistence	Scheduled task, registry key, new service created	Defender for Endpoint (DeviceRegistryEvents)
4. Privilege escalation	Local admin exploit, token theft, Kerberoasting	Defender for Identity, Defender for Endpoint
5. Lateral movement	PsExec, RDP, WMI, pass-the-hash	Defender for Identity, DeviceLogonEvents
6. Collection	Files accessed, databases queried, emails read	Purview Activity Explorer, Defender for Cloud
7. Exfiltration	Data uploaded, DNS tunnelling, email forwarding	Defender for Cloud Apps, network logs
8. Impact	Ransomware deployed, data destroyed, systems disrupted	Defender for Endpoint, Sentinel alerts

Investigation approach

Step 1: Establish the timeline

Start with the first alert and work forward. When did the attack begin? What was the initial access vector?

Use the unified incident timeline in Defender XDR to see all alerts chronologically across all products.

Step 2: Map the blast radius

Identify every compromised entity:

• Users — which accounts were compromised or used by the attacker?
• Devices — which endpoints were touched?
• Applications — which apps or services were accessed?
• Data — what sensitive data was accessed or exfiltrated?

The Sentinel investigation graph is the fastest tool for this — it visually maps entity relationships.

Step 3: Trace lateral movement

Lateral movement is the hardest to trace. Look for:

Indicator	Where to Find It
RDP connections between internal hosts	DeviceLogonEvents (LogonType = RemoteInteractive)
PsExec usage	DeviceProcessEvents (FileName = “psexec.exe” or “psexesvc.exe”)
WMI remote execution	DeviceProcessEvents (InitiatingProcessFileName = “wmiprvse.exe”)
Pass-the-hash	Defender for Identity alerts (NTLM authentication anomalies)
Service creation on remote hosts	DeviceRegistryEvents, DeviceEvents
Unusual admin logons	Entra ID sign-in logs, DeviceLogonEvents

Step 4: Contain simultaneously

Do not contain one device at a time. In a multi-stage attack, containing the first device alerts the attacker to move faster on the others.

Best practice: Identify all compromised devices, then contain them simultaneously — isolate all devices and disable all compromised accounts at the same time.

💡 Scenario: Elena traces a ransomware attack chain

Elena at Atlas Bank is called in for a ransomware incident. Three servers are already encrypted.

Timeline reconstruction:

• Day 0 (2 weeks ago): Phishing email to a finance analyst. Defender for Office 365 shows the email had a malicious macro attachment.
• Day 1: The analyst opened the attachment. MDE shows winword.exe spawning powershell.exe (ASR rule was in Audit mode, not Block).
• Days 2-10: The attacker established persistence (scheduled task), escalated privileges (Kerberoasting a service account), and moved laterally via PsExec to 5 servers.
• Day 11: The attacker accessed the file server and exfiltrated 50 GB of data to a cloud storage service (MDCA detected the upload but the alert was missed).
• Day 14: Ransomware deployed across 3 servers simultaneously.

Elena’s response:

1. Isolate all 5 compromised servers + the analyst’s workstation simultaneously
2. Disable the compromised service account and the analyst’s account
3. Reset the service account password (25+ character random)
4. Engage the backup team to begin restore from last known good backup
5. Switch the “Block Office from creating child processes” ASR rule from Audit to Block
6. Create indicators for all IOCs found (C2 IPs, file hashes, domains)

Key learning: The ASR rule in Audit mode and the missed MDCA alert were the two preventable gaps.

Multi-domain investigation tools

Tool	Best For
Unified incident timeline	Chronological view of all alerts across all products
Investigation graph	Visual entity relationship mapping
Advanced Hunting	Cross-table KQL queries to find specific evidence
Entity pages	Deep-dive into individual users, devices, or IPs
Copilot for Security	AI-assisted summarisation and guided investigation
Threat analytics	Check if the attack matches a known campaign

Question

What are the four key questions to answer during a complex attack investigation?

Click or press Enter to reveal answer

Answer

1. How did they get in? (initial access vector) 2. Where did they go? (lateral movement and blast radius) 3. What did they take? (data access and exfiltration) 4. Are they still here? (persistence mechanisms and active sessions)

Click to flip back

Question

Why should you contain all compromised devices simultaneously during a multi-stage attack?

Click or press Enter to reveal answer

Answer

Containing devices one at a time alerts the attacker, who may accelerate their attack on the remaining compromised systems. Simultaneous containment (isolating all devices and disabling all accounts at once) prevents the attacker from pivoting to unconstrained systems.

Click to flip back

Question

What are three common indicators of lateral movement?

Click or press Enter to reveal answer

Answer

1. PsExec usage (psexec.exe or psexesvc.exe processes on remote hosts). 2. RDP connections between internal hosts (RemoteInteractive logon type). 3. Pass-the-hash (NTLM authentication anomalies detected by Defender for Identity). Also: WMI remote execution and unusual service creation on remote machines.

Click to flip back

Knowledge Check

During a ransomware investigation, Elena discovers that the attacker moved from a workstation to 5 servers over 10 days using PsExec. Three servers are already encrypted. What should she do with the 2 unencrypted servers?

AMonitor them closely for the next 24 hours to gather more evidenceBShut down the entire networkCRun antivirus scans but keep them onlineDIsolate them immediately to prevent the ransomware from spreading

Check Answer

Knowledge Check

James is investigating a phishing-to-ransomware attack chain. He needs to identify the exact sequence of events across email, endpoint, identity, and cloud signals. Which tool provides the best chronological cross-domain view?

AUnified incident timeline in Defender XDRBSentinel investigation graphCActivity Explorer in PurviewDAdvanced Hunting with a single KQL query

Check Answer

Knowledge Check

Elena investigates a multi-stage attack at Atlas Bank. She discovers: (1) phishing email 2 weeks ago, (2) credential theft via Kerberoasting, (3) lateral movement to 5 servers, (4) data exfiltration of 50 GB, (5) ransomware deployed on 3 servers. The ASR rule 'Block Office from creating child processes' was in Audit mode. The MDCA upload alert was missed by Tier 1. What TWO things should Elena recommend as post-incident improvements?

ADisable all Office macros globally and block all cloud storage uploadsBSwitch the ASR rule from Audit to Block, and create an automation rule to escalate MDCA data exfiltration alerts to Tier 2CReplace Defender for Endpoint with a third-party EDR solutionDIncrease the Sentinel Data lake retention from 1 year to 7 years

Check Answer

Next up: Complex attacks often end at the endpoint. Let’s deep-dive into device investigation — timelines, live response, and collecting forensic evidence.