What are the specific heuristics used by modern network anomaly detection systems to spot internal reconnaissance and lateral movement before data exfiltration occurs?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
What are the specific heuristics used by modern network anomaly detection systems to spot internal reconnaissance and lateral movement before data exfiltration occurs?
3 real searches · 1 real-search pass
MITRE ATT&CK network service scanning remote services lateral movement detection analytics internal reconnaissanceGoogle ↗
OBSERVED
Microsoft Defender for Identity lateral movement reconnaissance detection suspicious network activity behavioral analyticsGoogle ↗
OBSERVED
CISA detecting lateral movement network logs internal reconnaissance indicatorsGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 3 queries…
Searches and sources
ChatGPT3 real searches · gpt-6
MITRE ATT&CK network service scanning remote services lateral movement detection analytics internal reconnaissance Google ↗
Microsoft Defender for Identity lateral movement reconnaissance detection suspicious network activity behavioral analytics Google ↗
CISA detecting lateral movement network logs internal reconnaissance indicators Google ↗
- CAR-2021-01-001: Identifying Port Scanning Activity · car.mitre.org
- Exploitation of Remote Services, Technique T1210 - Enterprise · attack.mitre.org
- Microsoft Defender for Identity Overview - Microsoft Defender for Identity · learn.microsoft.com
- Inside Microsoft 365 Defender: Attack modeling for finding and stopping lateral movement · microsoft.com
- Exploitation of Remote Services – multi-platform lateral movement detection, Detection Strategy DET0118 · attack.mitre.org
- JOINT CYBERSECURITY ADVISORY Technical Approache · cisa.gov
- AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity · content.govdelivery.com
- Joint Guidance: Identifying and Mitigating Living Off the Land Techniques · ic3.gov
- Official website · zeek.org
- Official website · suricata.io
- Documentation · learn.microsoft.com
- ATT&CK knowledge base · attack.mitre.org
Queries
3 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
MITRE ATT&CK network service scanning remote services lateral movement detection analytics internal reconnaissance OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Microsoft Defender for Identity lateral movement reconnaissance detection suspicious network activity behavioral analytics OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
CISA detecting lateral movement network logs internal reconnaissance indicators OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |