Facing lateral movements using widespread behavioral probes

The fast evolving nature and the growing complexity of modern offensive techniques used in Advanced Persistent Threats attacks calls for innovative approaches to defense techniques. Common network monitoring solutions fail in case of attacks able to remain silent and quietly control the network for long periods of time. Indeed, such type of attacks requires the deployment of security functionality able to recognize the so called lateral movements, exploited by the attackers to spread the infection inside the network. The implementation of a distributed monitoring infrastructure exploiting innovative detection approaches allows to overcome the lack of a single monitoring point and successfully detect complex behavior of lateral movements. In this paper we demonstrate how to effectively use eXtended Finite State Machine patterns to face a set of commonly used lateral movement techniques, including IP spoofing ones.