What signs or anomalous behaviors should we look for to detect lateral movement in our local network if an attacker manages to breach our perimeter?