Huntress explains how their Managed EDR product detects lateral movement by focusing on two key pillars: remote authentication and remote code execution on the target machine. Rather than tracking network connections on the source side (which generates too many false positives), they correlate logon session data with process execution on the remote host. This approach covers techniques like DCOM, WinRM, RDP, and PowerShell Remoting. Real-world detection wins include catching SQL admin credential abuse, ransomware precursor activity (shadow copy deletion, LSASS dumping, credential staging), and protocol abuse via tools like Impacket, CrackMapExec, and NetExec. The layered telemetry model enables higher-fidelity detections with lower noise for SOC analysts.
