How do threat actors typically bypass standard network monitoring to achieve lateral movement, and how can we spot them faster?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
How do threat actors typically bypass standard network monitoring to achieve lateral movement, and how can we spot them faster?
1 real search · 1 real-search pass
MITRE ATT&CK lateral movement detection techniques remote services valid accounts Windows management instrumentation detection CISA logging best practicesGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 1 queries…
Searches and sources
ChatGPT1 real searches · gpt-6
MITRE ATT&CK lateral movement detection techniques remote services valid accounts Windows management instrumentation detection CISA logging best practices Google ↗
- Lateral Movement, Tactic TA0008 - Enterprise · attack.mitre.org
- Techniques - Enterprise · attack.mitre.org
- Remote Services: Windows Remote Management, Sub-technique T1021.006 - Enterprise · attack.mitre.org
- Exploitation of Remote Services – multi-platform lateral movement detection, Detection Strategy DET0118 · attack.mitre.org