Lateral Movement Detection With Decoys and Breadcrumbs

Lateral movement is an attacker using a stolen credential and a protocol your own engineers use every day, so most of it gets caught late or in hindsight. Deception detects it by changing the question: instead of judging whether an authentication was legitimate, you put a destination in the network that no legitimate session has any reason to reach, and treat arrival as the alert.

Detection built on behavior has to classify valid activity. Detection built on decoys has to answer a yes-or-no question about a host that has no users.

Why this step is the hard one

An intruder moving through a network is rarely running anything that looks like malware. They authenticate. They mount an admin share, open a remote shell, query the directory, copy a tool across. Every one of those actions appears thousands of times a day in a normal enterprise, performed by people whose job it is to perform them.

So the detection has to be contextual, and context is expensive. Was this administrator supposed to reach that subnet? Is that service account normally used interactively? Is 2 AM unusual for this person? Each of those is a reasonable question and each of them produces a queue, because the answer is a probability and the volume is high. Teams respond by raising thresholds, and raising thresholds is how lateral movement gets through.

A decoy removes the context problem by removing the legitimate population. There is no baseline for a host nobody uses. The question collapses from "was this access appropriate" to "was there any access at all."

The three things an attacker needs

To move, an intruder needs a target to move to, a credential that works there, and a protocol to carry it. Deception plants fakes in the first two and turns the third into evidence.

The target. They find it by enumerating (T1018 remote system discovery, T1046 network service discovery, T1135 network share discovery). Enumeration is indiscriminate by design, because the attacker does not know what is out there. Decoy hosts sitting on unused address space in each segment are discovered by the same sweep that discovers the real ones.

The credential. They find it by dumping, harvesting, or roasting (T1003 OS credential dumping, T1552.001 credentials in files, T1558.003 Kerberoasting). Breadcrumbs live at this step: an inert credential in a config file, a stale entry in a credential store, a service account that looks worth attacking. Nobody uses them, so they only ever leave the host in the hands of someone harvesting. Breadcrumbs are files and entries, not agents, and nothing is installed on the production system.

The protocol. They use the ones already permitted, and there is nothing to fake about SMB or SSH. What the protocol gives you is attribution: the session carries the source host, and the credential carries the host it was planted on.

Together those make the detection clean. A breadcrumb credential you planted, arriving at a decoy from a workstation, is not a judgement call. The attacker has stolen something and is spending it.

The movement step, by technique

The IDs are here so you can line this against your existing coverage map and see which rows you detect twice and which not at all.

Remote services (T1021). The main road. SMB and Windows admin shares (T1021.002), RDP (T1021.001), SSH (T1021.004), WinRM (T1021.006), DCOM (T1021.003), and increasingly cloud service interfaces (T1021.007). A decoy that presents these services is reachable by the same tooling as a real host, and it has no users, no scheduled jobs and no dependencies. Strip out your own scanning and inventory, which you can enumerate in advance, and nothing is left that should be connecting.

Alternate authentication material (T1550). Pass the hash (T1550.002) and pass the ticket (T1550.003) skip the password entirely, which defeats detections that assume a login event involves a person typing. The decoy does not care. It is the destination, not the authentication path, that is anomalous.

Lateral tool transfer (T1570). Staging a binary or script onto the next host. A decoy that receives a dropped file hands you the artifact along with the alert. Most lateral movement detections give you metadata and leave you to go find what was copied.

Session hijacking (T1563). RDP hijacking (T1563.002) and SSH hijacking (T1563.001) ride an existing authenticated session rather than creating a new one, so identity-based detection has very little to work with. Again, the decoy is indifferent, because the hijacked session still has to connect somewhere.

Exploitation of remote services (T1210). An unpatched internal service, reached from inside. On a production host you have to tell exploitation apart from normal use of the service. A decoy has no normal use, so the exploit attempt is the only traffic there is.

Software deployment tools (T1072). Moving via the management platform that is allowed to touch everything. Hard to detect, because the platform's whole function is mass remote execution. Decoy endpoints enrolled in that platform's scope receive the same push, and when one executes something it was not scheduled to, the platform itself is compromised. That is a finding you very rarely get any other way.

Internal spearphishing (T1534). Movement between people rather than hosts, using an already-trusted internal mailbox. This is the row decoys on the network do not cover, and it is covered instead by Human Firewall and Social Deception, which treat staff as sensors against the social-engineering attacks they actually face.

Placement table

If you only build two rows, build the stolen-credential row and the RDP/WinRM row. Those two fire while the attacker is still working out where they are, which is the point at which containment is still cheap.

What the SOC receives

The test of a lateral movement alert is whether an analyst can act on it without first writing a correlation search. A decoy alert carries the asset touched, the source, the identity used, and where that identity was planted. That last field names a host the attacker already owns:

severity    : high
decoy       : jmp-ops-03  (decoy jump host, 10.18.44.0/24)
event       : WinRM session established
auth        : NTLM hash, no interactive logon
source      : 10.18.9.61  (SRV-MGMT-02)
identity    : svc_patchmgr  (breadcrumb credential)
planted at  : SRV-MGMT-02, credential manager entry, 63 days ago

Two hosts are now in scope and you did not have to go looking for either. The credential was planted on SRV-MGMT-02 and the session came from SRV-MGMT-02, which says the attacker is operating from the host where they found it rather than having moved on. Alerts arrive enriched and deduplicated in the tooling the SOC already runs, including Splunk, Microsoft Sentinel, IBM QRadar, and Google Chronicle.

[[TODO: confirm the real alert field names, severity values, and which protocols decoys present out of the box (SMB, RDP, WinRM, SSH) before this block goes live.]]

The segments nobody instruments

East-west traffic is where lateral movement happens and where visibility is usually worst. Flat legacy subnets, the manufacturing network behind a jump host, the lab that predates the current architecture, the acquired company's address space. These are the places an agent rollout stalls and a traffic sensor is expensive or politically impossible.

A decoy is a host, not a tap. It needs address space and a route, not a span port or an agent on anything, so per-segment coverage is a provisioning task rather than a project. Coverage spans IT, OT and industrial control systems, IoT, and cloud, and is planned against MITRE ATT&CK so placement follows the techniques you are exposed to instead of wherever provisioning happened to be easy.

Next to EDR, NDR, SIEM and identity tooling

Deception adds a layer. The boundaries matter more than the pitch.

EDR is better on any host where it is installed: process lineage, in-memory behavior, what the attacker ran after they arrived, and blocking. Deception sees only what touches a decoy. What it adds is precisely the case EDR finds hardest, where the activity is valid credentials and native binaries and therefore does not resemble malware. We have written about that asymmetry in scaling living off the land engagement.

NDR is better at protocol analysis and volumetric patterns at scale, and it will see movement between real hosts that never touches a decoy. It needs a sensor in the path to do that. Deception does not inspect production traffic at all.

Identity and UEBA tooling own the authentication record and are the right place to spot impossible logins and privilege changes. They work on probability, which is their strength when you need coverage of every account and their weakness when you need something you can page on at 3 AM.

SIEM is where this lands. Deception does not reduce your log sources. It adds one with an unusually high signal-to-noise ratio, which is the rare case where automated escalation is defensible.

The honest limits. Placement decides everything: decoys in segments the attacker never visits detect nothing, and an attacker who compromises one host and stops moving will not trip anything. Your own vulnerability scanners and asset inventory will reach decoys, so write down the expected benign triggers and who owns them before the on-call analyst meets them at 3 AM. A skilled adversary may fingerprint a decoy, though they have to touch it to try, and the touch is the alert. An alert nobody owns is decoration, which is a process problem rather than a product one.

Where to start

The cheapest honest test is one segment. Stand up decoy hosts on unused addresses in a subnet that matters, plant breadcrumb credentials on a handful of real servers in it, then run your own discovery sweep and your own authentication attempt. Either the alert fires with the planting host attached, or it does not.

Decoy Management provisions, blends, and retires those assets from one control plane. That is the difference between covering a subnet and covering an estate. If ransomware is the specific outcome you are defending against, the same placement reads differently and is covered in ransomware early detection. For background on deception as a detection layer generally, see a practical guide to modern cyber deception.

See it running on your network.