Detecting Lateral Movement

Sat, 30 May 2026 00:00:00 +0000

Once an attacker has a foothold, the interesting part begins: moving from the first host toward whatever they actually came for. That east-west movement leaves traces if you know which events to join.

Signals worth joining

Lateral movement rarely shows up as a single smoking-gun event. It emerges from correlation:

Network logon events (4624 type 3) from unusual sources
Service or scheduled-task creation on the destination
Remote process creation shortly after

Correlate across hosts, not just within one. A single 4624 is noise; a chain of them following an account around the estate is a story.

Getting started with Threat Hunting with a minimal approach

Sat, 27 Sep 2025 00:00:00 +0000

Start Hunting Today!

Threat hunting doesn’t require enterprise tools. You can simply start with what you already have.

Minimum Requirements

Start with things you probably already have. Work from there, and then think about improving and growing.

Centralized logging (Sysmon, firewall, proxy logs)
Query capability (ELK, Splunk, or even grep)
Baseline knowledge of your network
2-4 hours per week of dedicated hunting time

Baselining is the hardest part for beginners, so start small. Pick one thing you can describe as “normal” (which hosts talk to the internet, which accounts run as admin, what runs at startup) and write it down. That single baseline becomes the yardstick for your first hunts.

Threat-Hunting on Suspicious Bytes

Detecting Lateral Movement

Signals worth joining

Getting started with Threat Hunting with a minimal approach

Start Hunting Today!

Minimum Requirements