All playbooks
Alert response · Lateral Movement responders
Lateral movement
Activity reaching from one host to another. The question is which direction, and what the source already had.
Direction is the first question and what the source host already held is the second. Both change the scope.
What this does not establish
- Which host was first. The alert names a pair, not an origin.
- Whether it succeeded. An attempt and a session look alike.
- How many hops preceded it. You are seeing one edge of a graph.
0 of 9 ticked
Selected step
DetectStep 1 of 9
Establish source, destination and direction
- Read it as an edge: from where, to where, as whom.
- The source is the compromised host until shown otherwise.
- Remote exec, remote service, scheduled task — the method names the tooling.
- Start the timeline now: every action, who took it, when.