What are the best indicators of compromise to watch out for when trying to spot lateral movement in a mixed Mac and Windows home network?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
What are the best indicators of compromise to watch out for when trying to spot lateral movement in a mixed Mac and Windows home network?
3 real searches · 1 real-search pass
CISA lateral movement detection indicators Windows macOS home network logs SMB RDP SSHGoogle ↗
OBSERVED
Microsoft Windows security auditing lateral movement logon events SMB remote services official documentationGoogle ↗
OBSERVED
Apple macOS unified logging remote login sharing security official documentationGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 3 queries…
Searches and sources
ChatGPT3 real searches · gpt-6
CISA lateral movement detection indicators Windows macOS home network logs SMB RDP SSH Google ↗
Microsoft Windows security auditing lateral movement logon events SMB remote services official documentation Google ↗
Apple macOS unified logging remote login sharing security official documentation Google ↗
- AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity · content.govdelivery.com
- JOINT CYBERSECURITY ADVISORY Technical Approache · cisa.gov
- Audit logon events - Windows 10 · learn.microsoft.com
- Audit Other Logon/Logoff Events - Windows 10 · learn.microsoft.com
- Remote Services: SMB/Windows Admin Shares, Sub-technique T1021.002 - Enterprise · attack.mitre.org
- Exploitation of Remote Services – multi-platform lateral movement detection, Detection Strategy DET0118 · attack.mitre.org
- Indicator Removal: Clear Network Connection History and Configurations, Sub-technique T1070.007 - Enterprise · attack.mitre.org
- CYBERSECURITY & INFRASTRUCTURE · cisa.gov
- Official website · wireshark.org
- Official website · wazuh.com
- Documentation · learn.microsoft.com
- Official website · osquery.io
Queries
3 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
CISA lateral movement detection indicators Windows macOS home network logs SMB RDP SSH OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Microsoft Windows security auditing lateral movement logon events SMB remote services official documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Apple macOS unified logging remote login sharing security official documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |