M ManySignal

Use Case: Endpoint

Lateral movement detection

A workstation authenticated to 12 internal servers over WMI in 8 minutes. No admin tool would do that. ManySignal flagged the pivot chain before the attacker reached the domain controller.

Book a demo Endpoint attack surface
Attack scenario

The pivot chain that ends at the domain controller

Lateral movement is the attacker's path from initial foothold to their actual target. After compromising a developer workstation via phishing, the attacker uses pass-the-hash to authenticate as a local administrator on adjacent systems. From there, they dump credentials from LSASS, find a cached domain admin token, and pivot to the domain controller. This chain is methodical, quiet, and well-understood — but it generates dozens of normal-looking Windows authentication events along the way.

ManySignal's network graph models the normal authentication relationships between every host pair. When a workstation that has never connected to a specific server suddenly initiates a WMI session, the deviation from baseline fires immediately — before the attacker reaches the next hop.

Detection logic 
rule: lateral_movement_graph_deviation
type: graph + behavioral
sources:
  - windows_security_events (4648, 4624, 4776)
  - sysmon (event 3 - network connection)
  - crowdstrike / sentinelone process events
  - active_directory_kerberos_logs
trigger:
  - event: remote_authentication (WMI, SMB, RDP, PsExec)
  - condition: |
      host_pair(source, dest) NOT IN historical_connections(30d)
      OR credential_type == "NTLM" AND logon_type == "Network"
      AND source NOT IN known_jump_boxes
enrichments:
  - host_role: asset_inventory
  - credential_context: ad_account_type
  - blast_radius: network_graph_traversal
  - persistence_check: scheduled_task, service_creation
mitre: T1021 (Remote Services), T1550.002 (Pass the Hash)
Triage agent questions
1

Which internal hosts did the source host attempt to authenticate to in the past 30 minutes?

WinEvent 4648 / Sysmon
2

Was WMI, PsExec, SMB, or RDP used for the lateral connection?

EDR process/network
3

Was the credential used a domain admin, service account, or standard user hash?

AD credential log
4

Is the source host a workstation, server, or jump box in the network topology?

Asset inventory
5

Did any new scheduled tasks or services appear on the destination host post-connection?

EDR file events
6

Did pass-the-hash or pass-the-ticket indicators appear (NTLM without Kerberos pre-auth)?

Domain controller log
Response playbook
1

Isolate the source host from lateral network segments via NAC or EDR policy

Approve-gated
2

Reset the credential used for lateral movement

Approve-gated
3

Capture memory from both source and destination hosts

Autonomous
4

Enumerate all sessions and new persistence mechanisms on destination host

Autonomous
5

Expand blast radius analysis: identify all hosts reachable from current pivot point

Recommend

MITRE ATT&CK mapping

T1021 — Remote ServicesT1550.002 — Pass the HashT1550.003 — Pass the TicketT1047 — Windows Management InstrumentationT1570 — Lateral Tool Transfer

Lateral movement FAQ

Does ManySignal detect pass-the-hash specifically?

Yes. Pass-the-hash leaves a distinct signature in Windows Security Event logs: NTLM authentication without a corresponding Kerberos TGT request, combined with a logon type 3 (network logon) from a non-typical source. ManySignal correlates both events from domain controller logs within the same session window.

What about lateral movement via legitimate admin tools like PsExec?

PsExec is flagged when used by accounts that don't typically perform remote administration, from source hosts that aren't designated jump boxes, or to destination systems outside the source's normal network peer group. Legitimate admin use from known jump boxes with ticketed change requests is suppressed.

Can ManySignal detect lateral movement in cloud environments?

Cloud lateral movement uses different primitives — AssumeRole, service account key creation, or VPC peering traversal. These are covered by the cloud privilege escalation and cloud persistence use cases, which share entity graph context with this endpoint lateral movement detection.

How is blast radius calculated?

ManySignal's network graph models trust relationships between hosts based on historical successful connections, shared service accounts, and network segment membership. Blast radius is the set of reachable hosts from the current pivot point using credentials already known to be compromised.

Map the pivot chain before the attacker reaches the domain controller

Graph-based lateral movement detection that models normal host-to-host communication patterns and flags every deviation.

Book a demo Explore the platform