What behavioral anomalies do security analysts look for to spot lateral movement during a live network breach investigation