Detecting Lateral Movement

An attacker with a foothold moves toward what they want. Each step uses valid credentials against a system the account is authorised to reach. No individual authentication is suspicious. The path is.

This is the clearest case where entity-level baselining is insufficient and relationship modelling is required.

Model the pairs

The unit of analysis is the edge: user to host, host to host, account to service.

User-to-host. Which machines does this account normally authenticate to? A logon to a host never previously touched by this account is meaningful even when both the account and the host are individually normal.

Host-to-host. Which machines normally communicate? Workstation-to-workstation traffic is unusual in most environments and is a classic movement indicator.

Account-to-service. Which services does this account normally consume? An account that has never used remote management suddenly using it is a strong signal.

Source-to-account. Which devices does this credential normally originate from?

A model holding these edge sets per entity, with first-seen timestamps, supports the questions that matter and costs little to build.

Signals worth implementing

New edge. First observed authentication between a user and a host, weighted by whether peers also traverse that edge. New for the user and common for the peer group is ordinary; new for both is not.

Path length. Number of distinct hosts reached within a session or a short window. Most accounts touch few machines; an account reaching eight in an hour is doing something different.

Direction. Movement from a lower-value segment toward a higher-value one, where segments are known.

Credential spread. One account authenticating from many source hosts in a short period. Frequently the clearest single indicator of harvested credentials in use.

Authentication type change. An account normally using one method suddenly using another — interactive where it was always service, or a legacy protocol where modern authentication is standard.

Service account interactive logon. Machine accounts should not log on interactively. Near-zero false positive rate, and it is one of the highest-precision detections available anywhere in this field.

Time-compressed sequences. Several authentications across hosts within seconds. Human working patterns have gaps; automated traversal does not.

Data requirements

Authentication logs from every host, not only domain controllers. Local authentication is invisible centrally, and it is precisely what an attacker prefers.

Consistent host identifiers. Hostname, address and asset identifier must resolve to one entity, or the graph fragments.

Network flow where authentication logging is incomplete.

Segment or zone labels to make direction meaningful.

Retention long enough for the edge set to be established. Thirty days of history produces many false "new edges" simply because the window is short.

Why deployments miss it

Only user entities are modelled. Without host entities and edges, the graph does not exist.

Only domain controller logs are collected. A large fraction of authentication never reaches them.

Baseline windows are too short. Everything looks new.

Alerts are per-event. One traversal is unremarkable; the path is the finding. Without correlating into a session or a path, the analyst sees eight uninteresting alerts and no pattern.

Administrative accounts are excluded because they generate noise. Administrators legitimately touch many hosts, so they are excluded, and then movement using administrative credentials is invisible — which is the case that matters most.

The correct handling for administrators is a separate model with different expectations, not exclusion.

Reducing noise

Administrative and support accounts genuinely traverse widely. Rather than excluding them:

Baseline them separately, against other administrators. Model the set of hosts rather than the count. Weight by target sensitivity — an administrator reaching a workstation is routine, reaching a domain controller from an unfamiliar source is not. Require a second condition, such as an unusual source or an unusual hour.

Building the edge model

A practical specification, implementable on any platform holding authentication logs.

For each user-host pair, store: first seen, last seen, count, and whether any peer of that user also traverses the edge.

For each host-host pair, the same.

Maintain the set, not just counts. The question "has this user ever authenticated to this host" needs set membership, which is cheap to store and expensive to reconstruct.

Age the edges. An edge unused for six months should not count as familiar.

Score new edges by context: target sensitivity, whether peers traverse it, the user's normal breadth, the time compression of the traversal, and whether the source is familiar.

Correlate traversals into paths within a session window. The finding is the path, not each hop. Alerting per hop produces eight uninteresting alerts and hides the pattern.

Common false positives

Legitimate activity that resembles movement, and how to recognise it:

Support and helpdesk work, where broad host access is the job. Baseline this population separately rather than excluding it.

Vulnerability scanning and asset discovery, which authenticate broadly on a schedule. Exclude the scanner accounts explicitly.

Software deployment and patching, touching many hosts in a compressed window.

Migrations, where entire populations legitimately access new systems for the first time.

Incident response, where responders traverse widely and urgently.

Load-balanced or proxied services that present one source address for many users, collapsing distinct entities into one apparent traverser.

Blind spots and assumptions

That authentication is logged everywhere. Coverage gaps are the norm and they concentrate on older systems.

That the graph is complete. Missing edges look like new edges.

That movement crosses monitored boundaries. Within a flat segment it may generate no crossing at all.

That legitimate movement is stable. Support work, incident response and migrations all produce genuine bursts of new edges, and they will be indistinguishable without context.