What methods do modern network detection tools use to uncover lateral movement when attackers are leveraging native admin protocols like PowerShell?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
What methods do modern network detection tools use to uncover lateral movement when attackers are leveraging native admin protocols like PowerShell?
2 real searches · 1 real-search pass
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
MITRE ATT&CK lateral movement PowerShell WinRM WMI SMB detection network behavioral analytics Google ↗
Microsoft Defender XDR detect lateral movement PowerShell remote services network telemetry Google ↗
- CAR-2014-11-006: Windows Remote Management (WinRM) · car.mitre.org
- Remote Services: Windows Remote Management, Sub-technique T1021.006 - Enterprise · attack.mitre.org
- Windows Management Instrumentation, Technique T1047 - Enterprise · attack.mitre.org
- Lateral Movement, Tactic TA0008 - Enterprise · attack.mitre.org
- Lateral Tool Transfer, Technique T1570 - Enterprise · attack.xn--zsss51h.xn--rhqv96g
- New Privileged Token Context Telemetry Boosts Advanced Hunting in Microsoft Defender · techcommunity.microsoft.com
- Inside Microsoft 365 Defender: Attack modeling for finding and stopping lateral movement · microsoft.com
- Behavioral Detection of WinRM-Based Remote Access, Detection Strategy DET0477 · attack.mitre.org
- Exploitation of Remote Services – multi-platform lateral movement detection, Detection Strategy DET0118 · attack.mitre.org
- GitHub - mitre-attack/bzar: A set of Zeek scripts to detect ATT&CK techniques. · github.com
- Active Directory Lateral Movement Detection: Threat Research Release, November 2021 · splunk.com
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
MITRE ATT&CK lateral movement PowerShell WinRM WMI SMB detection network behavioral analytics OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Microsoft Defender XDR detect lateral movement PowerShell remote services network telemetry OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |