What specific indicators of compromise should our incident response team look for to detect lateral movement across our internal network segments today?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
What specific indicators of compromise should our incident response team look for to detect lateral movement across our internal network segments today?
1 real search · 1 real-search pass
CISA lateral movement detection indicators Windows event logs SMB RDP remote services 2026Google ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 1 queries…
Searches and sources
ChatGPT1 real searches · gpt-6
CISA lateral movement detection indicators Windows event logs SMB RDP remote services 2026 Google ↗
- Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity, Detection Strategy DET0327 · attack.mitre.org
- Multi-Event Detection for SMB Admin Share Lateral Movement, Detection Strategy DET0530 · attack.mitre.org
- Exploitation of Remote Services – multi-platform lateral movement detection, Detection Strategy DET0118 · attack.mitre.org