Tracking Lateral Movement Across Endpoints and Network Traffic with NDR

If an attacker lands on a workstation, he is not interested in that station much. The actual objective is not here, but rather a domain controller, backup server, share packed with contracts. It will take a few hops to get there and defenders need to be able to catch those hops.

What is Lateral Movement?

MITRE ATT&CK describes lateral movement as the techniques adversaries use to enter and control remote systems on a network. It follows initial access. The attacker maps the environment, picks out machines worth reaching, and moves through accounts, hosts, and services until they arrive. The destination might be a database, an admin workstation, a cloud workload, a backup platform, or an OT segment.

On the wire, it looks mundane. An RDP session to a server. A workstation opening several file shares. A service account logging in from a host it has never used. A box sweeping internal IP ranges before trying SMB. Any one of these means little. Strung together, they describe an intruder.

Why is lateral movement difficult to detect?

Lateral movement refers to the techniques that adversaries use to enter and control remote systems on a network, according to MITRE ATT&CK. It follows on initial access. The attacker scans the environment, selects machines to be attacked and traverses accounts, hosts and services to get to the target. It could be to a database, an admin workstation, a cloud workload, a backup platform or an OT segment.

When it’s on the wire, it’s an everyday occurrence. A Remote Desktop Session to a server. A workstation with multiple file shares. A service account attempting to log in from a host that it has not previously logged into. A box sweeping internal IP ranges prior to attempting SMB. Each of these is a minor consideration. When put together, they form a description of an intruder.

How NDR Detects Lateral Movement

NDR records what happens be tween hosts when they talk to each other, as well as east-west traffic. It learns who normally talks to whom, over what protocol, when and how loud, and identifies when that isn’t happening. From this perspective, you can view which hosts are communicating, if it’s a normal communication for that host, if the account is accessing unusal assets, and if internal traffic is growing or moving towards staging/exfiltration for ransomware. Endpoint tools record what happened on a host. Identity tools record logins. NDR records the traffic be tween them.

What Network Behaviors Can Indicate Lateral Movement?

Plenty of unusual traffic is harmless. These patterns earn a closer look:

A workstation starting RDP, SMB, SSH, WinRM, WMI, or RPC sessions to systems it never contacted, especially when it isn’t an admin machine
Port scans, host enumeration, or Active Directory queries followed by login attempts
Service accounts logging in interactively or from new hosts
One user machine reaching many servers in a short window
Odd LDAP, Kerberos, SMB, or RPC activity aimed at domain controllers
Remote access tools turning up in unexpected places or at unusual hours
Heavy file-share traversal or archive creation, which often means data is being staged

Detailed Lateral Movement Detection Workflow

Baseline normal communication be tween peer groups, protocols, zones, and authentication paths.
Flag what falls outside it: rare source and destination pairs, unusual protocols, internal scanning, unexpected access to sensitive assets.
Enrich the alert with asset criticality, identity context, DNS, DHCP, threat intelligence, endpoint telemetry, and SIEM logs.
Reconstruct the session from full-packet capture and metadata, so the verdict rests on what crossed the wire.
Follow related hosts, users, sessions, and time windows to see whether the event stands alone or belongs to a larger pattern.
Contain. Isolate hosts, reset credentials, end sessions, change firewall rules, run SOAR playbooks, and open a deeper forensic review where needed.

NDR works alongside SIEM, EDR, and identity security, and fills the gap they leave: network evidence.

What’s the Best Approach to Investigate Lateral Movement Across Endpoints and Network Traffic?

Begin with the network, confirm on the endpoint, and bring in identity last. The network shows the route. The endpoint shows what ran. Identity shows which accounts made it possible. Put all three on one timeline.

In practice:

Take the network alert and note source, destination, protocol, and timestamp.
Check both endpoints for that window. Look at the process tree, command lines, new services (Event ID 7045), and scheduled tasks (4698).
Look at the logon. A type 3 network logon or a type 10 remote interactive logon in Event ID 4624, plus a 4672 for special privileges, tells you how access was gained.
Follow the account. Where else did it authenticate in the last day, and did its privileges change?
Replay the session from packets. This separates a genuine PsExec-style push over ADMIN$ from a sysadmin doing routine work.
List every host the source or account touched, then contain them together.

Skip the network and you miss the hop be tween hosts. Skip the endpoint and you can’t say what executed.

How NetWitness NDR helps in Lateral Movement Detection

NetWitness NDR is built around investigation. When it raises a flag, it also hands analysts the network evidence behind it, which matters most when attackers hold legitimate credentials and use standard protocols.

Full-packet capture for forensic validation
Metadata enrichment for quick searching and pivoting
Behavioral analytics for abnormal internal movement
Threat intelligence correlation against known attacker infrastructure
Session reconstruction and network forensics
Visibility across on-premises, cloud, and virtual environments
Integration with SIEM, EDR, SOAR, identity logs, DNS, DHCP, and asset context

Alert-only tools leave analysts asking which system talked to which, over what protocol, under which account, and what came before and after. NetWitness keeps those answers a few clicks from the alert.