Detecting lateral movement: East-west network visibility 

Attackers don’t just break in; they move. East to west, system to system, deeper into your network. And that internal lateral movement is precisely where most security tools lose visibility.

Key takeaways

• 96% of lateral movement does not trigger alerts in traditional security tools (Gigamon, 2024 Hybrid Cloud Security Survey).
• EDR and perimeter tools provide incomplete east-west coverage in the terrain where lateral movement actually happens.
• Network Detection and Response (NDR) closes that gap through multi-layered detection, combining behavioral rules, anomaly detection, and machine learning (ML) to surface lateral movement that no single method can catch alone. 

1. What is lateral movement in cybersecurity?

Lateral movement is the phase of a cyberattack in which an adversary, having already gained a foothold inside your network, systematically navigates from system to system in search of valuable data, elevated privileges, and the access required to complete their mission. It is not the break-in. It is the internal movement that often follows initial access.

Unlike the initial intrusion, which crosses a perimeter, lateral movement travels east-west, not in and out through the network boundary, but laterally between internal systems. A compromised workstation becomes a launchpad for reaching a domain controller. A service account becomes a key to an administrative share. Each hop extends the attacker’s reach and deepens the damage they can cause. Understanding how attackers move, and what they use to do it, is the foundation of effective detection.

Common lateral movement techniques and examples

Stages of lateral movement

Lateral movement unfolds in stages, each building on the last:

• Reconnaissance: The attacker maps the internal network, identifying active systems, open ports, shared resources, domain structure, and high-value targets. This is often the first application of living-off-the-land techniques: Native OS commands and built-in Windows tools used to enumerate the environment without introducing new software.
• Credential access: Attackers harvest valid credentials to enable movement without triggering malware-based alerts. Techniques include Kerberoasting, credential dumping via tools like Mimikatz, and Pass-the-Hash.
• Privilege escalation: The attacker elevates from standard user access to administrative or domain-level privileges, unlocking access to a wider range of systems and data. The same credential-based techniques that enabled initial movement, including Pass-the-Hash and Kerberoasting, are frequently used here to acquire higher-value credentials.
• Lateral movement execution: Using the credentials and privileges gained, the attacker moves from system to system, putting protocol abuse into action. RDP, SMB, and WinRM (legitimate administrative protocols) carry the movement, making each hop indistinguishable from normal IT activity at the endpoint level.
• Staging and pre-exfiltration: Before data leaves the network, it is aggregated and compressed on internal staging servers, ready for extraction. File transfers over SMB or administrative shares make this stage visible at the network layer, even when endpoints show nothing unusual.

The gap in the comparison above is not simply a gap in tools. It is a gap in terrain. No amount of investment in endpoint or perimeter security addresses the east-west blind spot. That requires a different category of solution entirely. Gartner defines NDR as products that “continuously analyze raw network packets or traffic metadata between internal networks (east-west) and public networks (north-south).” The existence of NDR as a distinct analyst-recognized market category is itself evidence that east-west monitoring is a gap traditional tools do not fill.

Network Detection and Response (NDR) addresses this gap directly. Where EDR watches managed endpoints and perimeter tools watch the network boundary, NDR watches the network itself, monitoring east-west traffic between internal systems in real time, across managed and unmanaged devices alike. It is the detection layer purpose-built for the terrain where lateral movement actually happens.

3. How to detect lateral movement: Addressing the east-west network visibility blind spot

How NDR detects lateral movement

The east-west visibility gap established in Section 2, the terrain EDR and perimeter tools leave unmonitored, is precisely what Network Detection and Response (NDR) is built to address. NDR complements rather than replaces existing controls: EDR covers managed endpoints, perimeter tools cover the network boundary, and NDR provides continuous visibility across east-west and north-south traffic, monitoring activity in real time across managed and unmanaged devices alike.

To uncover threats in lateral movement, NDR applies multi-layered detection to that traffic through four complementary methods, each catching what the others miss. In today’s advanced threat landscape, further complicated by AI-powered threats, no single method is sufficient on its own:

• Signature-based detection (known tools and techniques): Fast and effective for known threats, matching network traffic against known-bad indicators, catalogued attack patterns, and file-based signatures including static analysis approaches such as YARA. Where signature-based detection reaches its limit is precisely where lateral movement most commonly occurs: the credential-based and LotL techniques at the heart of most attacks use valid credentials and legitimate OS tools, leaving nothing for a signature to match. This is why the detection layers that follow are essential.

• Behavioral detection (known traffic procedures): Expert-encoded detection rules map observed network behavior to MITRE ATT&CK techniques, firing on patterns that match known attack methodologies, including variations that have been slightly modified to evade signatures. Unlike single-indicator rules, behavioral detection examines multiple criteria simultaneously: an indicator alone may be innocuous, but a specific sequence of indicators across specific protocols from a specific source type is the behavioral fingerprint of a known attack technique. Behavioral detection fires immediately without requiring a learned baseline. Implementation varies: some vendors use Zeek scripting to chain these criteria into high-fidelity detections; others use AI-based approaches, which are more resource-intensive.

• Supervised ML (behavior and pattern variations): Supervised ML is trained on historical east-west attack data to recognize lateral movement not by exact signature match, but by behavioral similarity to past intrusions. An attacker who modifies their tooling but follows the same general sequence (reconnaissance, credential access, lateral movement, staging) will still be caught because the overall pattern resembles campaigns the model has seen before. This makes supervised ML particularly effective against sophisticated actors who actively engineer around known detection rules.

• Anomaly detection / unsupervised ML (suspicious activity): Learns over time by establishing behavioral baselines for every device, subnet, and session, flagging deviations from normal east-west traffic patterns that signature and behavioral rules would miss. Most effective against novel and credential-based lateral movement where no prior rule exists. Requires a learning period before reaching full effectiveness.

† EDR footnote: “Partial” reflects three distinct constraints: (1) agent coverage, because EDR only monitors managed, enrolled devices; (2) session visibility, because EDR observes east-west connections from one endpoint’s perspective only, never the full session; and (3) protocol-level gaps, because certain network-layer signals require wire-level observation that endpoint telemetry cannot replicate.

‡ Perimeter footnote: “Limited” indicates perimeter tools observe the outbound exfiltration phase only, not the internal lateral movement that precedes it.

4. How to mitigate lateral movement: Best practices

Mitigating lateral movement requires both architectural decisions and operational discipline, and the speed of modern attacks means these practices must be in place before an attacker arrives, not after. With average breakout times now measured in minutes, the window between initial access and full lateral movement is narrower than most incident response processes can close.

Architecture and access controls

• Segment the network into discrete zones with enforced boundaries between them.
• Apply least privilege to all accounts and service credentials.
• Apply zero trust principles by verifying every user and device continuously rather than granting implicit trust based on network location; limits the blast radius of a compromised credential even when lateral movement has begun.
• Disable or restrict administrative protocols (RDP, SMB, WinRM) where not operationally required.
• Audit and remove stale accounts and accounts with excessive privileges on a defined schedule.
• Enforce multi-factor authentication on all administrative accounts and remote access pathways.

Visibility and detection

• Deploy continuous east-west traffic monitoring, since periodic or perimeter-only monitoring leaves internal movement invisible.
• Establish behavioral baselines for every subnet, user group, and device category before an incident occurs (specific to anomaly-based detection; behavioral/TTP and supervised ML detections do not require baseline establishment).
• Capture structured network evidence across all east-west protocols, including SMB file movement, Kerberos authentication, connection metadata, SSL/TLS sessions, and RDP activity, enabling search and correlation across all entity interactions.
• Monitor administrative share access for connections from non-administrative or unexpected sources.
• Enable anomaly detection for RDP, SSH, executable file transfers, and VPN usage across internal subnets.
• Extend visibility to unmanaged devices, cloud environments, and OT/ICS networks.

Response and containment

• Define and test containment procedures against a defined breakout time window, since lateral movement can progress to full breach in minutes.
• Automate initial alert triage using GenAI-powered tools. Agentic Triage correlates network evidence, executes expert playbooks, and delivers investigation-ready conclusions in minutes rather than hours.
• Correlate network evidence with endpoint and identity data to reconstruct the full attack path.
• Treat network evidence as the authoritative record, since it cannot be tampered with by an attacker who does not control network infrastructure.
• Conduct post-incident review of east-west traffic logs to identify dwell time, movement patterns, and detection gaps.
• Update threat detection rules, training, and models as necessary.

5. How Corelight NDR closes the gap

East-west visibility as the core capability

Corelight’s Open NDR platform provides continuous visibility across east-west and north-south traffic. It is purpose-built for the east-west terrain where lateral movement actually happens, helping to close the visibility gap that EDR and perimeter tools leave open. Corelight captures every internal session, including SMB, Kerberos, RDP, and SSL/TLS, in structured logs with full protocol context across managed and unmanaged devices. More than 70 log types linked by a Unique Connection ID enable analysts to reconstruct the full attack path in a single query.

Its multi-layered detection strategy means each layer catches what the others cannot. Signature-based detection, including YARA static file analysis, catches known malware and tools immediately. Zeek-scripted behavioral detections are packaged as continuously updated Collections covering lateral movement, C2, and exfiltration. Per-environment baselines, anomaly detection, and unsupervised ML surface behavioral deviations that no rule could anticipate. Supervised ML catches evolved attack variants that retain the behavior of past intrusions. Additional layers support broader detection workflows, including IOCs, threat intelligence, and proactive threat hunting capabilities.