Can you give me the exact steps to detect lateral movement in our Windows domain controllers immediately after getting an alert about suspicious internal traffic
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
Can you give me the exact steps to detect lateral movement in our Windows domain controllers immediately after getting an alert about suspicious internal traffic
2 real searches · 1 real-search pass
Microsoft Windows security auditing event IDs 4624 4625 4648 4672 4768 4769 4776 7045 4697 lateral movement domain controller investigationGoogle ↗
OBSERVED
Microsoft Defender XDR advanced hunting lateral movement Windows domain controllers DeviceLogonEvents DeviceNetworkEvents documentationGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
Microsoft Windows security auditing event IDs 4624 4625 4648 4672 4768 4769 4776 7045 4697 lateral movement domain controller investigation Google ↗
Microsoft Defender XDR advanced hunting lateral movement Windows domain controllers DeviceLogonEvents DeviceNetworkEvents documentation Google ↗
- Audit logon events - Windows 10 · learn.microsoft.com
- 4624(S) An account was successfully logged on. - Windows 10 · learn.microsoft.com
- Security Event Logging · soc.cyber.wa.gov.au
- Get relevant info about an entity with go hunt - Microsoft Defender XDR · learn.microsoft.com
- DeviceLogonEvents table in the advanced hunting schema - Microsoft Defender XDR · learn.microsoft.com
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
Microsoft Windows security auditing event IDs 4624 4625 4648 4672 4768 4769 4776 7045 4697 lateral movement domain controller investigation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Microsoft Defender XDR advanced hunting lateral movement Windows domain controllers DeviceLogonEvents DeviceNetworkEvents documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |