Autonomous Lateral Movement in Linux Environments
Stephan Wampouille demonstrates autonomous lateral movement in Linux networks, chaining benign system behaviors to traverse internal infrastructure undetected.
Summary
The Concept of Autonomous Lateral Movement
While manual lateral movement requires continuous operator intervention, autonomous implants can parse local telemetry and self-propagate across network segments.
Chaining Benign Behaviors to Evade Detection
Stephan Wampouille illustrates how multiple individually benign Linux commands—such as SSH key discovery, network probing, and cron job inspection—can be chained together.
Automated Telemetry Parsing in RAT Architectures
The author demonstrates an agent architecture that parses remote command responses in real time, automatically extracting new IP targets and injecting credentials into downstream commands.
Defending Linux Networks Against Autonomous Spreading
Wampouille outlines defensive containment strategies, including strict host-based firewalling, ephemeral SSH certificates, and zero-trust network segmentation.
Related talks
Password Village·13 min
EvilMog
Demonstrates pivoting from compromised networked printers into Active Directory environments to forge Kerberos silver tickets.
Password Village·12 min
EvilMog
Walks through exploiting embedded printer credentials to pivot across domain infrastructure and mint silver tickets.
Red Team Village·58 min
Tyler Boykin
Tyler Boykin reviews Linux privilege escalation vectors stemming from sudoers misconfigurations, from common GTFOBins low-hanging fruit to subtle binary abuse.