What indicators of compromise should I look for when investigating potential lateral movement on Linux servers?