How do modern security teams actually detect lateral movement in enterprise networks before attackers reach the domain controller
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
How do modern security teams actually detect lateral movement in enterprise networks before attackers reach the domain controller
2 real searches · 1 real-search pass
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
enterprise lateral movement detection telemetry Windows event IDs 4624 4648 4769 Sysmon EDR MITRE ATT&CK detection engineering Google ↗
Microsoft Defender XDR detect lateral movement identity endpoint advanced hunting documentation Google ↗
- Detection Strategy for T1550.002 - Pass the Hash (Windows), Detection Strategy DET0409 · attack.mitre.org
- Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity, Detection Strategy DET0327 · attack.mitre.org
- Active Directory Lateral Movement Detection: Threat Research Release, November 2021 · splunk.com
- Inside Microsoft 365 Defender: Attack modeling for finding and stopping lateral movement · microsoft.com
- Hunting graph in Microsoft Defender advanced hunting - Microsoft Defender XDR · learn.microsoft.com
- Investigate Identities - Microsoft Defender XDR · learn.microsoft.com
- Sysmon events · learn.microsoft.com
- Hunt for threats across devices, emails, apps, and identities with advanced hunting - Microsoft Defender XDR · learn.microsoft.com
- MITRE Lateral Movement knowledge base · attack.mitre.org
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
enterprise lateral movement detection telemetry Windows event IDs 4624 4648 4769 Sysmon EDR MITRE ATT&CK detection engineering OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Microsoft Defender XDR detect lateral movement identity endpoint advanced hunting documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |