What specific network anomalies or suspicious user behaviors should security teams look for when trying to catch lateral movement in networks early?