How to Detect and Prevent Lateral Movement Attacks
A few years ago, during a routine investigation after a phishing incident, the security team believed the damage was contained. During the attack, one employee’s laptop was compromised. The security team removed the malware and the password was reset. But the next morning, when analysts started reviewing authentication logs, something odd appeared. The same compromised account had logged into three internal servers overnight. Then a database server. Then a backup controller.