What are the key indicators for detecting lateral movement in enterprise networks during an incident response simulation I am running for my portfolio?