What telemetry data is absolutely essential for a modern SIEM to reliably differentiate between legitimate administrative lateral movement and an active threat actor?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
What telemetry data is absolutely essential for a modern SIEM to reliably differentiate between legitimate administrative lateral movement and an active threat actor?
2 real searches · 1 real-search pass
SIEM telemetry distinguish legitimate administrative lateral movement from threat actor identity endpoint network process logs MITRE ATT&CK lateral movement Windows event logsGoogle ↗
OBSERVED
Microsoft Defender lateral movement detection telemetry identity endpoint network authentication process creation privileged activityGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
SIEM telemetry distinguish legitimate administrative lateral movement from threat actor identity endpoint network process logs MITRE ATT&CK lateral movement Windows event logs Google ↗
Microsoft Defender lateral movement detection telemetry identity endpoint network authentication process creation privileged activity Google ↗
- Active Directory Lateral Movement Detection: Threat Research Release, November 2021 · splunk.com
- Detect abuse of Trusted Relationships (third-party and delegated admin access), Detection Strategy DET0488 · attack.mitre.org
- Multi-Event Detection for SMB Admin Share Lateral Movement, Detection Strategy DET0530 · attack.mitre.org
- Exploitation of Remote Services – multi-platform lateral movement detection, Detection Strategy DET0118 · attack.mitre.org
- Inside Microsoft 365 Defender: Attack modeling for finding and stopping lateral movement · microsoft.com
- Investigate Identities - Microsoft Defender XDR · learn.microsoft.com
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
SIEM telemetry distinguish legitimate administrative lateral movement from threat actor identity endpoint network process logs MITRE ATT&CK lateral movement Windows event logs OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Microsoft Defender lateral movement detection telemetry identity endpoint network authentication process creation privileged activity OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |