﻿---
title: Lateral Movement Detection Model
description: The Lateral movement detection model package contains assets that detect lateral movement based on file transfer activity and Windows RDP events. This...
url: https://docs-v3-preview.elastic.dev/elastic/integration-docs/tree/main/reference/lmd
---

# Lateral Movement Detection Model
|                                                                                                                                                       |                                        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------|
| **Version**Version                                                                                                                                    | 2.5.4 ([View all](#changelog)View all) |
| **Subscription level**Subscription level[What's this?](https://www.elastic.co/subscriptions)What's this?                                              | Platinum                               |
| **Developed by**Developed by[What's this?](https://docs-v3-preview.elastic.dev/elastic/integration-docs/tree/main/reference/developed-by)What's this? | Elastic                                |

The Lateral movement detection model package contains assets that detect lateral movement based on file transfer activity and Windows RDP events. This package requires a Platinum subscription. Please ensure that you have a Trial, Platinum, or Enterprise subscription before proceeding. This package is licensed under [Elastic License 2.0](https://www.elastic.co/licensing/elastic-license).
This package leverages event logs. Prior to using this integration, you must have Elastic Endpoint via Elastic Defend, or have equivalent tools/endpoints set up. If using Elastic Defend, Elastic Defend should be installed through Elastic Agent and collecting data from hosts. See [Configure endpoint protection with Elastic Defend](https://www.elastic.co/docs/solutions/security/configure-elastic-defend) for more information. The transform only supports Linux and Windows. The **Anomaly Detection Jobs** section outlines platform support for each job.
For more detailed information refer to the following blogs:
- [Detecting Lateral Movement activity: A new Kibana integration](https://www.elastic.co/blog/detecting-lateral-movement-activity-a-new-kibana-integration)
- [Identifying malicious Remote Desktop Protocol (RDP) connections with Elastic Security](https://www.elastic.co/blog/remote-desktop-protocol-connections-elastic-security)


## Installation

1. **Upgrading**: If upgrading from a version below v2.0.0, see the section v2.0.0 and beyond.
2. **Add the Integration Package**: Install the package via **Management > Integrations > Add Lateral Movement Detection**. Configure the integration name and agent policy. Click **Save and Continue**. (Note that this integration does not rely on an agent, and can be assigned to a policy without an agent.)
3. **Check the health of the transform**: The transform is scheduled to run every hour. This transform creates the index `ml-rdp-lmd`. To check the health of the transform go to **Management > Stack Management > Data > Transforms** under `logs-lmd.pivot_transform-default-<FLEET-TRANSFORM-VERSION>`.
4. **Create data views for anomaly detection jobs**: The anomaly detection jobs under this package rely on two indices. One has file transfer events (`logs-*`), and the other index (`ml-rdp-lmd`) collects RDP session information from a transform. Before enabling the anomaly detection jobs, create a data view with both index patterns.
   1. Go to **Stack Management > Kibana > Data Views** and click **Create data view**.
2. Enter the name of your respective index patterns in the **Index pattern** box, i.e., `logs-*, ml-rdp-lmd`, and copy the same in the **Name** field.
3. Select `@timestamp` under the **Timestamp** field and click on **Save data view to Kibana**.
4. Use the new data view (`logs-*, ml-rdp-lmd`) to create anomaly detection jobs for this package.
5. **Add preconfigured anomaly detection jobs**: In **Stack Management -> Anomaly Detection Jobs**, you will see **Select data view or saved search**. Select the data view created in the previous step. Then under `Use preconfigured jobs` you will see **Lateral Movement Detection**. When you select the card, you will see pre-configured anomaly detection jobs that you can create depending on what makes the most sense for your environment. ***Note***: In the Machine Learning app, these configurations are available only when data exists that matches the query specified in the [lmd-ml file](https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json#L10). For example, this would be available in `logs-endpoint.events.*` if you used Elastic Defend to collect events.
6. **Data view configuration for Dashboards**: For the dashboard to work as expected, the following settings need to be configured in Kibana.
   1. You have started the above anomaly detection jobs.
2. You have **read** access to `.ml-anomalies-shared` index or are assigned the `machine_learning_user` role. For more information on roles, please refer to [Built-in roles in Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/built-in-roles.html). Please be aware that a user who has access to the underlying machine learning results indices can see the results of *all* jobs in *all* spaces. Be mindful of granting permissions if you use Kibana spaces to control which users can see which machine learning results. For more information on machine learning privileges, refer to [setup-privileges](https://www.elastic.co/guide/en/machine-learning/current/setup.html#setup-privileges).
3. After enabling the jobs, go to **Management > Stack Management > Kibana > Data Views**.  Click on **Create data view** with the following settings:
   - Name: `.ml-anomalies-shared`
- Index pattern : `.ml-anomalies-shared`
- Select **Show Advanced settings** enable **Allow hidden and system indices**
- Custom data view ID: `.ml-anomalies-shared`
   ***Warning***: When creating the data views for the dashboards, ensure that the `Custom data view ID` is set to the value specified above and is not left empty. Omitting or misconfiguring this field may result in broken visualizations, as illustrated by the error message below.
   ![Dashboard Error](https://docs-v3-preview.elastic.dev/elastic/integration-docs/tree/main/reference/images/lmd/dashboard-lmd-error.png)
7. **Enabling detection rules**:  You can also enable detection rules to alert on Lateral Movement activity in your environment, based on anomalies flagged by the above ML jobs. As of version 2.0.0 of this package, these rules are available as part of the Detection Engine, and can be found using the tag `Use Case: Lateral Movement Detection`. See this [documentation](https://www.elastic.co/guide/en/security/current/prebuilt-rules-management.html#load-prebuilt-rules) for more information on importing and enabling the rules.
8. **Use with Living off the Land Detection**: This integration package can be used along with Living off the Land detection, see the section Install Living off the Land package to detect malicious processes.

![Data Exfiltration Detection Rules](https://docs-v3-preview.elastic.dev/elastic/integration-docs/tree/main/reference/images/lmd/lmdrules.png)
*In Security > Rules, filtering with the “Use Case: Lateral Movement Detection” tag*

## Dashboard

After the anomaly detectors and the data views for the dashboard are configured, the **Lateral Movement Detection Dashboard** is available under **Analytics > Dashboard**. This dashboard gives an overview of anomalies triggered for the lateral movement detection package.

### Install ProblemChild package to detect malicious processes

To detect malicious RDP processes started in a session, install the [Living off the Land Attack (LotL) Detection package](https://docs.elastic.co/integrations/problemchild). Follow the steps under the package [overview](https://docs.elastic.co/integrations/problemchild) to install the related assets. Use the below filter query to examine model predictions on RDP events only.
Clone the anomaly detection jobs available under the Living off the Land Attack (LotL) Detection package and follow the below steps to customize them only to process Windows RDP events in the datafeed:
1. Click on the **Actions** panel at the right-most corner of the anomaly detection job and then select the **Edit job** option.
2. Under the **Datafeed** panel, enter the below query to filter malicious RDP processes.

```
{
  "bool": {
    "minimum_should_match": 1,
    "should": [
      {
        "match": {
          "problemchild.prediction": 1
        }
      },
      {
        "match": {
          "blocklist_label": 1
        }
      }
    ],
    "must_not": [
      {
        "terms": {
          "user.name": [
            "system"
          ]
        }
      }
    ],
    "filter": [
      {
        "exists": {
          "field": "process.Ext.session_info.client_address"
        }
      },
      {
        "exists": {
          "field": "process.Ext.authentication_id"
        }
      },
      {
        "exists": {
          "field": "host.ip"
        }
      },
      {
        "term": {
          "event.category": "process"
        }
      },
      {
        "term": {
          "process.Ext.session_info.logon_type": "RemoteInteractive"
        }
      }
    ]
  }
}
```


## Anomaly Detection Jobs

Detects potential lateral movement activity by identifying malicious file transfers and RDP sessions in an environment.

| Job                                                   | Description                                                                                     | Supported Platform    |
|-------------------------------------------------------|-------------------------------------------------------------------------------------------------|-----------------------|
| lmd_high_count_remote_file_transfer                   | Detects unusually high file transfers to a remote host in the network.                          | Linux, macOS, Windows |
| lmd_high_file_size_remote_file_transfer               | Detects unusually high size of files shared with a remote host in the network.                  | Linux, macOS, Windows |
| lmd_rare_file_extension_remote_transfer               | Detects rare file extensions shared with a remote host in the network.                          | macOS, Windows        |
| lmd_rare_file_path_remote_transfer                    | Detects unusual folders and directories on which a file is transferred (by a host).             | macOS, Windows        |
| lmd_high_mean_rdp_session_duration                    | Detects unusually high mean of RDP session duration.                                            | Windows               |
| lmd_high_var_rdp_session_duration                     | Detects unusually high variance in RDP session duration.                                        | Windows               |
| lmd_high_sum_rdp_number_of_processes                  | Detects unusually high number of processes started in a single RDP session.                     | Windows               |
| lmd_unusual_time_weekday_rdp_session_start            | Detects an RDP session started at an usual time or weekday.                                     | Windows               |
| lmd_high_rdp_distinct_count_source_ip_for_destination | Detects a high count of source IPs making an RDP connection with a single destination IP.       | Windows               |
| lmd_high_rdp_distinct_count_destination_ip_for_source | Detects a high count of destination IPs establishing an RDP connection with a single source IP. | Windows               |
| lmd_high_mean_rdp_process_args                        | Detects unusually high number of process arguments in an RDP session.                           | Windows               |


## v2.0.0 and beyond

v2.0.0 of the package introduces breaking changes, namely deprecating detection rules from the package. To continue receiving updates to Lateral Movement Detection, we recommend upgrading to v2.0.0 after doing the following:
- Delete existing ML jobs: Navigate to **Stack Management -> Anomaly Detection Jobs** and delete jobs corresponding to the following IDs:
  - high-count-remote-file-transfer
- high-file-size-remote-file-transfer
- rare-file-extension-remote-transfer
- rare-file-path-remote-transfer
- high-mean-rdp-session-duration
- high-var-rdp-session-duration
- high-sum-rdp-number-of-processes
- unusual-time-weekday-rdp-session-start
- high-rdp-distinct-count-source-ip-for-destination
- high-rdp-distinct-count-destination-ip-for-source
- high-mean-rdp-process-args

Depending on the version of the package you're using, you might also be able to search for the above jobs using the group `lateral_movement`.
- Uninstall existing rules associated with this package: Navigate to **Security > Rules** and delete the following rules:
  - Spike in Remote File Transfers
- Unusual Remote File Size
- Unusual Remote File Directory
- Unusual Remote File Extension
- Malicious Remote File Creation
- Remote File Creation on a Sensitive Directory
- Spike in number of processes in an RDP session
- High mean of RDP session duration
- High variance in RDP session duration
- Unusually high number of process arguments in an RDP session
- Spike in number of connections made to a source IP
- Spike in number of connections made to a destination IP
- Unusual time or day for an RDP session start

Depending on the version of the package you're using, you might also be able to search for the above rules using the tag `Lateral Movement`.
- Upgrade the Lateral Movement Detection package to v2.0.0 using the steps [here](https://www.elastic.co/guide/en/fleet/current/upgrade-integration.html)
- Install the new rules as described in the *Enabling detection rules* section below

In version 2.1.2, the package ignores data in cold and frozen data tiers to reduce heap memory usage, avoid running on outdated data, and to follow best practices.

## Licensing

Usage in production requires that you have a license key that permits use of machine learning features.

## Screenshots

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.
<carousel>
  ![Anomaly detection alerts](https://epr.elastic.co/package/lmd/2.5.4/img/sample-screenshot_1.png)
</carousel>


## Changelog

<dropdown title="Changelog">
  | Version        | Details                                                                                                                                                                           | Kibana version(s)              |
  |----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------|
  | **2.5.4**2.5.4 | **Bug fix**Bug fix ([View pull request](https://github.com/elastic/integrations/pull/16209)View pull request)Add filtering for Elastic endpoint agents                            | 8.9.0 or higher9.0.0 or higher |
  | **2.5.3**2.5.3 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/15294)View pull request)Update documentation on configuring data view for dashboards | 8.9.0 or higher9.0.0 or higher |
  | **2.5.2**2.5.2 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/14696)View pull request)Update transform mappings to use ECS                         | 8.9.0 or higher9.0.0 or higher |
  | **2.5.1**2.5.1 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/14358)View pull request)Update platform support docs                                 | 8.9.0 or higher9.0.0 or higher |
  | **2.5.0**2.5.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/13687)View pull request)Remove time_of_day detector from anomaly jobs module         | 8.9.0 or higher9.0.0 or higher |
  | **2.4.0**2.4.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/13058)View pull request)Add exclusions for Elastic endpoint agents                   | 8.9.0 or higher9.0.0 or higher |
  | **2.3.0**2.3.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/12940)View pull request)Add support for Kibana `9.0.0`                               | 8.9.0 or higher9.0.0 or higher |
  | **2.2.0**2.2.0 | **Bug fix**Bug fix ([View pull request](https://github.com/elastic/integrations/pull/12427)View pull request)Fix bug in the pivot transform                                       | 8.9.0 or higher                |
  | **2.1.5**2.1.5 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/12168)View pull request)Add agent policy documentation                               | 8.9.0 or higher                |
  | **2.1.4**2.1.4 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/10820)View pull request)Remove scripted_metric aggregation from pivot transform      | 8.9.0 or higher                |
  | **2.1.3**2.1.3 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/9791)View pull request)Improve package installation documentation                    | 8.9.0 or higher                |
  | **2.1.2**2.1.2 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/8500)View pull request)Add query settings to ignore frozen and cold data tiers       | 8.9.0 or higher                |
  | **2.1.1**2.1.1 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/8320)View pull request)Add unattended flag for Serverless                            | 8.9.0 or higher                |
  | **2.1.0**2.1.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/8121)View pull request)Add serverless support                                        | 8.9.0 or higher                |
  | **2.0.0**2.0.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/7901)View pull request)Removing detection rules from the package                     | 8.9.0 or higher                |
  | **1.0.2**1.0.2 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/6588)View pull request)Added additional ml jobs and security rules to the package    | 8.8.0 or higher                |
  | **1.0.1**1.0.1 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/6241)View pull request)Add the Advanced Analytics (UEBA) subcategory                 | 8.5.0 or higher                |
  | **1.0.0**1.0.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/4974)View pull request)Added dashboard and released the package in production        | 8.5.0 or higher                |
  | **0.0.1**0.0.1 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/4833)View pull request)Initial release of the package                                |                                |
</dropdown>