What specific network traffic patterns or log signatures indicate that an attacker has achieved lateral movement across our internal VLANs today?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
What specific network traffic patterns or log signatures indicate that an attacker has achieved lateral movement across our internal VLANs today?
2 real searches · 1 real-search pass
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
MITRE ATT&CK lateral movement detection Windows remote services SMB RDP WinRM authentication logs Google ↗
CISA detecting lateral movement network logs east west traffic Windows event logs Google ↗
- Exploitation of Remote Services – multi-platform lateral movement detection, Detection Strategy DET0118 · attack.mitre.org
- Lateral Movement, Tactic TA0008 - Enterprise · attack.mitre.org
- Logon Session, Data Source DS0028 · attack.cloudfall.cn
- CYBERSECURITY · cisa.gov
- CYBERSECURITY & INFRASTRUCTURE · cisa.gov
- AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity · content.govdelivery.com
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
MITRE ATT&CK lateral movement detection Windows remote services SMB RDP WinRM authentication logs OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
CISA detecting lateral movement network logs east west traffic Windows event logs OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |