name: AN-DET-05 Lateral movement to mission control
details: |
  Detects east-west network flows from operator-network subnets to mission-control hosts that are
  not on the documented allow-list. Detects unusual protocol usage (SMB, RDP, WinRM) between
  workstations and mission-control servers. Implements AN-DET:05.
author: ethicallyHackingSpace
severity: high
type: query
class: lateral_movement
status: stable
date: 2026-06-07
mitre-attack:
  - TA0008
  - T1021
references:
  - https://attack.mitre.org/tactics/TA0008/
tags:
  - meteorstorm.an-det.05
  - meteorstorm.tdm.svc-cp-control-plane-13
  - attack.lateral-movement
logsource:
  product: network_flow
  category: connection
detection:
  selection_src_operator_net:
    src_subnet|in_zone: "operator-network"
  selection_dst_mission_control:
    dst_subnet|in_zone: "mission-control"
  selection_not_allowlisted:
    flow_allowlist_match: false
  selection_lat_movement_proto:
    dst_port|in:
      - 445
      - 3389
      - 5985
      - 5986
  condition: selection_src_operator_net and selection_dst_mission_control and selection_not_allowlisted and selection_lat_movement_proto
falsepositives:
  - Documented break-glass admin session with incident reference