Lateral Movement Detection: A Playbook You Can Implement This Quarter

How to use this#

These five detections are ordered by value per unit of tuning effort. Deploy them in sequence rather than in parallel: each one changes what "normal" looks like in the queue, and tuning two at once makes it impossible to attribute the noise.

Before writing any logic, confirm the telemetry exists across the estate — not in the lab, not on the servers, across the estate. Most detections that fail in production fail because collection was partial, and a detection with 60% host coverage produces confident negatives that are simply wrong.

1. Remote service creation#

Telemetry: service installation events, remote authentication events.

Creating a service on a remote host is uncommon in most estates outside deployment tooling, and it remains one of the most reliable indicators available.

• Expected noise: low to moderate, concentrated in management and deployment hosts.
• Tuning: allow-list source hosts belonging to deployment infrastructure. Record an owner for each entry. Do not allow-list by account name alone — accounts get reused.

2. Administrative share access from non-administrative hosts#

Telemetry: file share access events including share name and source host.

Access to administrative shares from a workstation, rather than from a management host, is a strong signal and inexpensive to evaluate.

• Expected noise: low, once backup and inventory agents are excluded.
• Tuning: exclude by source host, not by account. Review the exclusion set monthly.

3. Authentication from a host to an unusual set of destinations#

Telemetry: authentication logs with source and destination.

Rather than looking for a specific technique, this measures fan-out: how many distinct destinations a single source authenticated to within a window.

• Expected noise: moderate. Vulnerability scanners and inventory tools will dominate early results.
• Tuning: exclude known scanner sources explicitly, then alert on percentile change relative to the host's own history rather than on an absolute threshold.

4. Scheduled task creation on remote hosts#

Telemetry: task registration events with the creating account and source.

• Expected noise: low to moderate.
• Tuning: deployment tooling will account for nearly all legitimate volume. Allow by task name pattern and creating host together, never by either alone.

5. Credential material access on servers#

Telemetry: process access events targeting credential stores.

Highest value of the five, and the most demanding: it requires endpoint telemetry that many estates only have on workstations.

• Expected noise: low, but with meaningful false positives from security and backup tooling.
• Tuning: allow-list by full binary path and signature together. Re-verify after every agent upgrade, since paths and hashes change.

Coverage honesty#

Two broad detections and three narrow ones is a reasonable quarter. It is not comprehensive lateral movement coverage, and it should not be presented as such — overstating coverage is how detection programmes lose the credibility they need to request telemetry investment later.

Assessment#

Confidence is high for the detection logic, which is well established and widely deployed. The effort estimates assume an existing centralised logging platform and an analyst able to spend meaningful time on tuning; without both, the timeline extends rather than the outcome degrading.