How to Detect Lateral Movement: Signals That Reveal an Intruder

The problem with trying to detect lateral movement is not a shortage of alerts. It is that most alerts describe events when defenders need to see relationships.

A successful logon is normal. PowerShell is normal. An administrator creating a service can be normal too. Put those events in sequence, from an employee workstation through a reused service account to a file server the account has never touched, and the meaning changes. The unit of detection is not the tool. It is the new path.

That distinction matters because the clock is short. CrowdStrike reported in February 2026 that average criminal breakout time, the gap between initial access and movement to another system, fell to 29 minutes in 2025. That was 65 percent faster than 2024. The fastest case took 27 seconds, according to the 2026 CrowdStrike Global Threat Report announcement. A daily hunt cannot compete with a half hour attack. Detection has to assemble the route as events arrive.

What does it mean to detect lateral movement?

To detect lateral movement is to identify an unauthorized change in control between systems. The actor starts with one identity and host, uses a remote channel, reaches another system, and performs an action there. MITRE ATT&CK groups that goal under lateral movement tactic TA0008. The current page lists nine techniques, including Remote Services, exploitation of remote services, session hijacking, tool transfer, and use of alternate authentication material.

Do not turn that list into nine disconnected alerts. Ask one operational question: did control move from a source that should not administer the target? The proof can involve RDP, SMB, WinRM, SSH, a deployment tool, a cloud console, or a stolen token. The protocol changes. The relationship test holds.

The pillar guide to lateral movement and attack paths explains the full route from foothold to impact. Detection owns the narrower job of seeing a new hop soon enough to stop the next one.

Why do isolated events miss the attack?

Security products often split the evidence by control boundary. The identity system knows an account authenticated. The endpoint product knows a process started. The network sensor knows two addresses spoke. The directory knows the account is privileged. Four consoles each hold a quarter of the story, so four alerts look weak.

Attackers benefit from that separation. A remote administrator tool may be approved software. A service account may have broad access by design. SMB may be required for file operations. None is enough by itself. The abnormal fact is that this service account left a new workstation, reached five servers in ten minutes, and started a command interpreter on two of them.

Simple math explains why correlation saves time. Suppose a shift gets 240 remote logon alerts and each takes four minutes to check. That is 16 analyst hours. If relationship scoring groups the same activity into 18 source, identity, and target sequences, the queue becomes about 72 minutes at the same review rate. Correlation is not cosmetic. It changes whether the team can respond inside breakout time.

Which evidence reveals a lateral movement sequence?

Start with five fields that every movement case should answer: source, identity, channel, target, and action. Add time and asset role. If a record cannot answer those questions, it may still be useful telemetry, but it is not yet a case an operator can act on.

• Source: the device, workload, address, or cloud session that initiated access. Mark whether it is an approved management source.
• Identity: the user, service principal, local account, machine account, token, or key used. Record privilege and recent exposure evidence.
• Channel: RDP, SMB, WinRM, SSH, WMI, a management API, or a deployment service. Capture the actual protocol, not a vague network label.
• Target: the destination and its business role. A new edge to a print server differs from a new edge to identity, backup, or build infrastructure.
• Action: what followed access. Process creation, service installation, task creation, archive activity, discovery, or a second remote connection raises confidence.

This evidence model also limits overstatement. A remote logon proves access, not malicious intent. A process on the destination proves execution, not who typed the command. A chain of current observations can support a strong finding, but missing process or identity telemetry must stay visible.

Which signals deserve the first detection rules?

Begin with relationships that have little legitimate use. Workstation to workstation administration, a standard user reaching a domain controller, a server initiating RDP to an unrelated peer, or a service account appearing on a new device all deserve attention. High signal does not mean automatically malicious. It means the expected owner can answer quickly.

Then look for compressed sequences. A network logon followed by remote service creation. An RDP session followed by credential access. One identity touching several targets from a new source. Discovery followed by remote execution. Our guide to lateral movement techniques maps the main methods to their prerequisites and evidence.

Add sensitive destination rules last, but make them strict. Any new administrative edge into domain controllers, identity sync systems, hypervisors, backup consoles, security management, or build runners should carry a named owner and approved source. These are control plane systems. One successful hop can create many more.

How can a defender hunt for new remote access patterns?

The following Microsoft Defender XDR query groups successful remote logons by source address and account, then shows identities that reached at least three devices in ten minutes. Its fields come from the official DeviceLogonEvents schema. Tune the threshold and window to your environment. This is a hunting lead, not a verdict.

Review the results against approved management sources, asset tier, account role, and past access. A deployment service may reach 300 hosts on schedule. The same pattern from a finance laptop at 2:13 a.m. is a different case. Baselines should describe expected edges, not merely average event volume.

How should teams score a lateral movement alert?

Use a small decision table that an analyst can explain. Add two points for a source that is not an approved management device. Add two for a privileged identity. Add two for a sensitive target. Add one for a new source and target pair. Add two for execution on the destination within five minutes. Subtract two only when a current change record covers the exact source, account, target, and time.

A score of seven does not prove compromise. It earns immediate review. More important, every point names the evidence that drove priority. That makes the rule debuggable. If a maintenance job keeps scoring high, fix the source inventory or narrow the job rights. Do not create a broad exception that hides the next intrusion.

An evidence backed attack graph can improve this score by showing whether the new edge reaches a critical system through one or two more hops. Reach changes urgency. It does not replace the observed sequence.

What did a 2026 domain compromise teach defenders?

Microsoft published a domain compromise case on April 17, 2026 that showed why exposed credentials and lateral movement must be handled as one problem. After initial compromise and credential theft, the actor returned, sprayed passwords, and unlocked access to at least 14 servers through password reuse. The same case included Mimikatz, remote scheduled tasks, PsExec, WMI, LSASS dumping, and directory credential activity. Read the Microsoft incident analysis.

The recent development is predictive shielding in Defender. Microsoft says the capability can restrict identities likely exposed on a device before those identities are observed doing something malicious. The useful idea is broader than one product: credential exposure is an edge in the attack path. Containment should follow the likely exposed identities, not stop at isolating one host.

What should an analyst do when the rule fires?

First, preserve the sequence. Record the source, account, destination, logon time, protocol, destination process, and any subsequent targets. Second, ask whether the exact relationship is approved. A tool name is not approval. Find the system owner, change record, or management scope.

If the edge is not expected, contain the source and the exposed identity together. Reset or revoke affected credentials from a known clean administrative device. Hunt backward for credential access and forward for every target reached. Protect evidence before rebuilding. The alert queue is secondary once a route is confirmed.

Track unknowns in the case. If a target lacks process telemetry, say so. If network address translation obscures the source, mark the ambiguity. Deep endpoint context with AI driven analysis can help assemble these observations, but a model should not fill gaps with a confident story. Operators still approve containment and closure.

Which detection metrics tell the truth?

Count time from the first suspicious source and target edge to a usable case, not time from alert creation to ticket creation. Measure the share of sensitive systems with identity, process, and network evidence. Track how many confirmed routes were stopped before a second hop. Keep false positive reasons, since stale asset roles and overbroad exceptions are work items.

Raw alert counts reward noise. Mean time to close can reward premature dismissal. A better weekly review asks whether the team saw the route, knew what evidence was missing, contained the exposed identity, and verified that no later targets were reached. The guide to alert fatigue as a design problem explains why queue volume is a poor substitute for decision quality.

Frequently asked questions

What is the best single signal of lateral movement?

A new source, account, and target relationship followed by execution on the destination. No universal event ID proves movement across every protocol and platform.

Can a SIEM detect lateral movement by itself?

Central correlation can connect the evidence a SIEM receives. It cannot recover source, identity, process, or target context that was never collected or was discarded before ingestion.

How long should a lateral movement baseline be?

Start with 30 days, then account for monthly maintenance and quarterly jobs. Approved relationships should still have an owner and purpose. Age alone does not make an edge safe.

Does EDR replace network evidence?

No. Endpoint process and logon data explains activity on a host. Network evidence confirms reach and may cover unmanaged systems. Use both where the target warrants it.

The executive takeaway

Pick ten sensitive systems this week. List every source and identity allowed to administer them. Alert on any new edge, attach the next action on the destination, and give the result to an owner who can contain both the host and the credential. If your tools cannot produce that sequence, fix the evidence pipeline before buying another alert feed.