Lesson 94 — The Endpoint Incident Became Lateral Movement
WS-214 was compromised.
Then the same account appeared on another device.
Then another.
The attacker was moving.
Do not investigate the second device in isolation.
Reconstruct how access moved from the known compromised endpoint into the wider environment.
Case briefing
Investigation objective
Determine whether activity on additional devices represents lateral movement, identify the source and destination systems, and establish how far the incident has spread.
Investigator's rule
When a compromised identity appears on a new device, ask how it got there.
Stage 1 — define the known source
| Known evidence | Why it matters |
|---|---|
| WS-214 compromised | Potential source of movement |
| Compromised user identity | Credential or session may enable access |
| Suspicious PowerShell | Known execution activity |
| Outbound connections | Possible pivot toward other systems |
Start from what is confirmed
WS-214 is already part of the incident. Use it as the source pivot rather than beginning a disconnected investigation on every new device.
Movement needs a relationship
The same account appearing elsewhere is suspicious, but lateral movement requires evidence connecting source, destination, authentication or execution.
Stage 2 — find the identity across devices
let User = "alex@contoso.com";
DeviceLogonEvents
| where Timestamp > ago(4h)
| where AccountUpn =~ User
| project Timestamp,
DeviceName,
AccountUpn,
LogonType,
RemoteDeviceName,
RemoteIP,
ActionType
| order by Timestamp ascBuild the movement map
List each device, timestamp, logon type and remote source. The sequence can reveal whether activity radiated from the known compromised endpoint.
Logon type gives context
Interactive, network and remote logons represent different access patterns. Interpret them alongside the user's normal behaviour and device role.
Stage 3 — the first destination
Authentication plus execution is stronger
A logon event shows access. A related process appearing shortly afterwards can show that the access was actually used.
Device role changes impact
Movement from a workstation to a file server may expose shared data, additional credentials or paths to more systems.
Stage 4 — inspect destination execution
let Device = "SRV-FILE-02";
DeviceProcessEvents
| where Timestamp > ago(4h)
| where DeviceName =~ Device
| project Timestamp,
DeviceName,
AccountName,
InitiatingProcessFileName,
FileName,
ProcessCommandLine,
SHA1
| order by Timestamp ascLook for repeated technique
If the same command, script, tool or process relationship appears on multiple devices, that behavioural repetition can connect the activity.
But expect variation
An attacker may change commands or tools between systems. Search for the underlying behaviour as well as exact indicators.
Stage 5 — correlate source and destination
| Evidence | Supports movement? |
|---|---|
| Known compromised source | Yes — establishes origin context |
| Remote authentication to destination | Yes — establishes access path |
| Same compromised identity | Yes — connects account context |
| Execution immediately after logon | Yes — shows destination activity |
| Similar technique on another device | Yes — expands likely scope |
Correlation is cumulative
No single event has to tell the entire story. Multiple independent observations can combine into a defensible lateral-movement finding.
Keep alternatives alive
Administrative tools and legitimate remote access can produce similar telemetry. Validate whether the activity matches expected operations.
Stage 6 — scope by technique
DeviceProcessEvents
| where Timestamp > ago(4h)
| where ProcessCommandLine has_any
("powershell", "wmic", "psexec")
| summarize
FirstSeen=min(Timestamp),
LastSeen=max(Timestamp),
Events=count()
by DeviceName, AccountName, FileName
| order by FirstSeen ascBroad hunts need validation
Common administrative tools generate legitimate activity. Use the results to identify candidates, then correlate them with the incident timeline.
Do not turn tool names into verdicts
PowerShell, WMI and remote administration can all be legitimate. Behaviour, context and sequence determine meaning.
Stage 7 — map confirmed and suspected scope
Separate confirmed from suspected
Your scope map should distinguish systems with strong evidence from systems that merely require further investigation.
Unknown is a valid status
Do not force a clean or compromised verdict before the evidence supports one. Track unresolved devices explicitly.
Stage 8 — containment becomes coordinated
Contain the current attack state
Response should account for every confirmed foothold, not merely the first system discovered.
Consider credential exposure
Movement through additional systems may expose further accounts or privileges, requiring the identity scope to expand again.
Stage 9 — incident finding
Write movement as a chain
Document source, destination, identity, time and supporting execution evidence so another analyst can reconstruct why lateral movement was concluded.
Do not overstate the edge of scope
Clearly distinguish where movement is confirmed from where it is only suspected.
Decision point
Movement changes severity
A single compromised workstation and a multi-device intrusion have different operational impact, containment requirements and escalation needs.
The next question is data
Once the attacker has moved through the environment, determine what resources were accessed and whether sensitive information began leaving.
Lesson 94 key takeaways
- Use the known compromised endpoint as the starting source for lateral-movement analysis.
- Search the compromised identity across device logon telemetry.
- Map source, destination, time, logon type and execution.
- Authentication followed by suspicious execution strengthens the movement hypothesis.
- Device role changes the potential impact of movement.
- Search for repeated behaviours as well as exact indicators.
- Legitimate administrative tools require contextual validation.
- Separate confirmed, suspected and unknown scope.
- Contain every confirmed foothold, not only the first device discovered.
- Reassess credential exposure as movement expands.
- Document lateral movement as a defensible source-to-destination chain.
- Continue scoping until the evidence supports a stable boundary.
Module 10 — Complete SOC Investigation Scenarios
Lesson 94 expanded the endpoint incident into a multi-device lateral-movement investigation. Lesson 95 follows the attacker into cloud services when sensitive data begins leaving the environment.
Continue your SOC Analyst training
🔎 SOC Analyst Academy — Module 10: Complete SOC Investigation Scenarios
How do SOC analysts investigate lateral movement?
Lesson 94 of the Agent Foskett SOC Analyst Academy follows a compromised endpoint into additional devices and correlates remote authentication, identity activity, process execution and network evidence.
Scoping lateral movement across endpoints
Learn how to map source and destination devices, validate remote access, search repeated techniques, separate confirmed from suspected scope and coordinate containment across a multi-device incident.
