  5G networks are susceptible to cyber attacks due to reasons such as
implementation issues and vulnerabilities in 3GPP standard specifications. In
this work, we propose lateral movement strategies in a 5G Core (5GC) with
network slicing enabled, as part of a larger attack campaign by well-resourced
adversaries such as APT groups. Further, we present 5GLatte, a system to detect
such malicious lateral movement. 5GLatte operates on a host-container access
graph built using host/NF container logs collected from the 5GC. Paths inferred
from the access graph are scored based on selected filtering criteria and
subsequently presented as input to a threshold-based anomaly detection
algorithm to reveal malicious lateral movement paths. We evaluate 5GLatte on a
dataset containing attack campaigns (based on MITRE ATT&CK and FiGHT
frameworks) launched in a 5G test environment which shows that compared to
other lateral movement detectors based on state-of-the-art, it can achieve
higher true positive rates with similar false positive rates.
