Enhancing Lateral movement and Data Access Identification on Windows Systems
summary
LMDA provides two Velociraptor artifacts that aggregate and normalize Shellbags LNK Jumplists UAL event logs and RMM traces into a single timeline, tagging LM artifact entries as inbound or outbound and including timestamps user accounts paths and file sizes, while DA artifact outputs highlight sensitive paths. Outputs stream to Elastic/Graphana or a Jupyter notebook for node edge graphs and to an Excel reporting template that auto highlights HR Legal Payroll access—everything is configured to Velociraptor and works end to end.
AI-written summary · about
chapters (10)
- 0:00Lambda introduction
- 3:15Lateral movement basics
- 6:28Forensic artifacts in Lambda
- 10:38Lambda purpose and benefits
- 12:26How Lambda works under the hood
- 15:58VQL implementation
- 18:28Visualizing with Grafana and Jupyter
- 26:29Data access analysis
- 31:54Key takeaways
- 35:45Q&A
related talks
46mVelociraptor - Dig Deeper in Linux
01h 42mVelociraptor - Dig Deeper
39mSelf-Service Analytics using LLMs
40mMe, My Adversary & AI: Investigating & Hunting with Machine Learning
41mWhat the Log?! So Many Events, so Little Time...
31mSecuring hybrid cloud environments
48mHunting Stealth Adversaries with Graphs & AI
50mNetwork Defender Archeology: An NSM Case Study in Lateral Movement with DCOM