Lateral Movement

Lateral movement describes how an attacker expands access after gaining an initial foothold. A compromised application server might become a starting point for accessing another server, a database, or an administrative identity. The objective is often to reach valuable data or control systems while using legitimate protocols and credentials. Lateral movement is distinct from initial access and privilege escalation, although an attack can combine all three.

In cloud environments, movement can follow both network paths and identity relationships. An attacker might use stolen credentials to connect to another virtual machine, exploit an exposed internal service, or assume a role that grants access to resources in another account. Network isolation alone therefore does not eliminate lateral movement: an identity with excessive permissions may reach additional resources through cloud APIs without establishing a direct connection between workloads.

Design logging around the actual connectivity model. Identify workload subnets, network interfaces, peering connections, transit hubs, hybrid links, and account boundaries. VPC Flow Logs provide IP traffic metadata for supported interfaces, including addresses, ports, protocol, traffic volume, and ACCEPT or REJECT action. Collect both accepted and rejected traffic when investigating lateral movement. Rejected connections can expose probing, while accepted connections can reveal an attacker successfully using an allowed path.

Transit gateway flow logs add visibility into traffic traversing an AWS Transit Gateway, helping investigators trace movement between attached VPCs and hybrid networks. They do not replace workload-level visibility because traffic that remains inside a VPC does not traverse the transit gateway. Select log fields that preserve attachment and network context, and maintain historical mappings between addresses, interfaces, workloads, accounts, and owners. Otherwise, address reuse and infrastructure changes can make reconstruction unreliable.

Amazon Route 53 Resolver query logging provides DNS context for queries handled by the VPC Resolver. Unexpected lookups for internal administrative services or unfamiliar destinations can support an investigation when correlated with connection attempts. DNS logging does not establish that a connection occurred, and direct-IP connections produce no corresponding lookup. Resolver caching also means repeated queries answered from cache are not individually represented in Resolver query logs.

Network metadata cannot show which command ran or whether authentication succeeded. Correlate it with operating-system authentication logs, endpoint telemetry, application logs, and cloud API audit events. AWS CloudTrail can reveal role assumption and subsequent API activity; relevant data events require explicit configuration. For example, a web server making unusual SSH connections followed by successful logins on another server is stronger evidence than port 22 traffic alone. Suspicious role assumption followed by unusual resource access can reveal identity-based movement even without a direct workload-to-workload connection.

Detection should compare activity with expected communication patterns. New source-to-destination relationships, rapid connections to many internal hosts, and administrative protocols used by an application tier warrant investigation. An ACCEPT record proves neither successful authentication nor compromise, and a REJECT record does not by itself prove malicious intent. Deployment automation, vulnerability scanners, and management systems can produce similar patterns, so enrich alerts with asset roles and approved operational activity.

Broader logging improves reconstruction but increases ingestion, retention, and analysis costs. Flow logs are aggregated metadata rather than packet captures, can contain collection gaps, and are not an instantaneous detection mechanism. Centralize logs with restricted write access, protect retention, and correlate timestamps across sources. Reduce available movement paths through segmentation, narrowly scoped security rules, least-privilege identities, and controlled trust relationships; logging detects and explains movement but does not block it.