Why sequential alert analysis misses it
A conventional pipeline evaluates events one at a time and asks whether each is suspicious. Lateral movement is built to survive exactly that question. The compromised workstation authenticates to a file server, the file server's service account reaches a database, an administrative tool runs where administrative tools normally run. Every step passes.
Analysts do catch these chains, but usually after the fact and by hand, reconstructing the path from logs once something at the end of it went wrong. The reconstruction is possible because the evidence was always there. What was missing was anything continuously asking how the events connect.
That is a graph question rather than an event question, and it needs a data model that holds the relationships rather than a queue that holds the alerts.
Modelling the estate as a graph
Graph intelligence models every user, device, application and IP as a node, with the observed connections between them as edges. That turns questions which are expensive or impossible in an event store into ordinary traversals: what can reach this system, what did reach it, and by what route.
The entity relationship graph is built from live observation rather than from a network diagram, which matters because the diagram is usually a description of intent. What actually talks to what is frequently different, and the difference is where lateral movement lives.
Against that structure, multi-hop anomaly detection surfaces compromise reached through unusual intermediaries: a path that is technically permitted at every step but that nothing in the environment has ever traversed before, and that no peer of the originating entity has reason to.
- Multi-hop anomaly, where the route rather than any single hop is what has never been seen
- Zone boundary crossing, evaluated with awareness of the topology rather than as a flat rule
- Credential misuse along the chain, including concurrent sessions and source deviation
- Beaconing detection, for the low-frequency outbound pattern that usually precedes the movement
- First-seen peer pairs and protocol use for the entities involved
Predicting the next hop instead of reporting the last one
Once the estate is a graph, the question can be turned around. Rather than only asking where an attacker has been, graph topology combined with threat intelligence supports asking where they would go next, and pre-positioning the response there.
Attack path prediction ranks the plausible continuations from a compromised node: which systems are reachable, which of those are worth reaching, and which route requires the fewest additional privileges. That is the same analysis a competent attacker performs, run continuously by the defence.
The same model answers the question a business asks after a compromise is confirmed. If this device is owned, what is the downstream impact through the connections that actually exist. Blast radius is computed from observed conduits rather than estimated, which makes the containment decision a scoped one rather than a guess.
Hunting for it before an alert exists
Lateral movement frequently produces no alert at all, which is why hunting rather than alerting carries much of this work. Hunting agents run continuous hypothesis-driven searches around the clock, never paused by shift changes or backlog, against templates mapped to MITRE ATT&CK techniques.
Those hunts look for attacker tradecraft rather than indicators, which is what makes them effective where there is no IOC to match: behaviour consistent with discovery, with credential access, with remote service use. Beaconing detection contributes the other half, identifying the low-frequency outbound pattern consistent with a command-and-control channel that would otherwise sit below every volume threshold in the environment.
Findings from hunts and from detection converge on the same investigation. AuraXP™ takes whichever signal appears first, enumerates the affected entities, traces the attack path, assembles the timeline, and reaches a verdict with the evidence attached.
Containment that follows the chain
Containing lateral movement means acting on a set of entities rather than on the one that raised the alert, and getting that set wrong in either direction is costly. Too narrow and the attacker retains a foothold; too broad and the response causes the outage.
Because the investigation produces the affected entities and the route between them, containment can be scoped to what the evidence supports: isolating the hosts on the path, revoking the sessions and disabling the accounts used along it, and blocking the command-and-control infrastructure at the network edge.
Actions execute within 60 seconds of confirmation where policy permits, and every recommendation carries the specific evidence and affected entities that justified it, so the decision to contain a production system is one somebody can defend afterwards.
Frequently asked questions
What is lateral movement?
The stage of an intrusion where an attacker moves from the system they first compromised toward the systems they actually want, using credentials, remote services and administrative tooling. Each individual hop typically uses legitimate access, which is what makes it difficult to detect event by event.
Why can't a SIEM rule detect lateral movement?
Because no single event in the chain is anomalous. A rule evaluates events against a fixed condition; the attack is defined by the relationship between events across time and entities. Detecting it requires modelling those relationships, which is a graph problem rather than a matching problem.
What is multi-hop anomaly detection?
Identifying compromise that was reached through unusual intermediaries, where the route as a whole has never been observed even though each step is individually permitted. Single-event analysis cannot see it because there is nothing wrong with any one step.
What is attack path prediction?
Using the graph topology and threat intelligence to rank where an attacker would plausibly go next from a compromised node, so response can be positioned ahead of the movement rather than behind it. The same model computes blast radius: the downstream impact if a given device is compromised, derived from observed conduits.
How does beaconing detection relate to this?
Beaconing is the low-frequency outbound pattern consistent with a command-and-control channel, and it usually precedes or accompanies lateral movement. It sits below ordinary volume thresholds, so it is found by continuous hunting rather than by alerting.
Does this require agents on every host?
No. The graph is built from telemetry the platform already ingests across endpoint, identity, network and cloud sources. EdgeProtect™ adds process, network and operating system detail where endpoint agents are deployed, and in OT environments Spharaka Signal™ contributes the same relationship data from passive collection.
How is containment scoped without causing an outage?
The investigation produces the affected entities and the route between them, so containment targets what the evidence supports rather than a broad segment. Every recommended action carries the evidence that justified it, and high-impact actions hold for approval under AirWatch™ policy.
Autonomous threat hunting
The continuous hunts that find it without an alert.
Credential compromise
How the movement usually starts.
Ransomware defence
What the movement is usually leading to.
Beyond XDR
Correlation across every layer in one place.
What autonomous threat hunting is
The method behind the hunts.