domains / families / security / performing-lateral-movement-detection

performing-lateral-movement-detection

separate

'Detects lateral movement techniques including Pass-the-Hash, PsExec,

When to use

• SOC teams need to detect attackers pivoting between systems after initial compromise
• Incident investigations require tracking an attacker's movement path through the network
• Detection engineering needs lateral movement rules mapped to ATT&CK TA0008 techniques
• Red/purple team exercises identify lateral movement detection gaps

When not to use

• detecting initial access
• external attacks

Skill page

Source