How to spot lateral movement without a SOC
Lateral movement is how an intrusion on one machine spreads to the rest of the network. An attacker gets onto a single workstation, for example through a phishing email, and then works across the network toward domain controllers, file servers and backup systems. If you notice it early you may only have one machine to clean up; if you don't, you can end up rebuilding the domain.
The common techniques all leave traces in the standard Windows event logs. Below are four patterns worth watching for.
PsExec and remote service creation
PsExec is one of the most common lateral movement tools in real-world intrusions. According to the Cisco Talos 2025 Year in Review, RDP, PowerShell, and PsExec are the top three tools used by ransomware actors. On the target machine, look for Event ID 7045 (service installed) with a service name like PSEXESVC or a random string, and Event ID 5145 showing access to the IPC$ share with the svcctl named pipe. When you see IPC$ access followed by a new service, someone has most likely just run something remotely on that machine.
Pass-the-hash and NTLM relaying
When an attacker dumps credentials from memory (with a tool such as Mimikatz) and reuses the hash to authenticate, you'll see Event ID 4624 with Logon Type 9 (NewCredentials) on the source machine, and a Logon Type 3 using NTLM rather than Kerberos on the target. In a healthy domain most authentication should be Kerberos, so a burst of NTLM Type 3 logons between workstations needs a closer look.
WMI remote execution
Attackers use WMI to run commands remotely because it's built into Windows and doesn't need anything installed on the target. On the source machine, look for Event ID 4648 (logon with explicit credentials) where the target server name contains "RPCSS" or "HOST". On the target, you'll see a 4624 Type 3 logon followed by wmiprvse.exe starting unexpected child processes in the process creation logs.
RDP from unexpected sources
Because RDP is used legitimately every day, malicious sessions are harder to pick out. Look for Event ID 4624 Type 10 between two workstations rather than from a jump server or admin machine. RDP from the loopback address 127.0.0.1 suggests the session is being tunneled over SSH. Sessions outside business hours are also worth checking. Event ID 1149 in the TerminalServices-RemoteConnectionManager log records the source IP of each RDP connection.
What these have in common is one machine connecting to another in a way it normally doesn't. If WORKSTATION-05 has never talked to your file server before and then authenticates to it, to the domain controller and to three other workstations within ten minutes, treat it as lateral movement until you can explain it. Arden has lateral movement rules for techniques like the ones above and raises an alert when one of them matches. It won’t catch every case, so no alert doesn’t mean no attack.
Lateral movement usually starts with stolen credentials, so the step before it is often a credential dump. Our guide to detecting LSASS credential dumps covers that. For the basics, see the 5 Windows Event IDs every system administrator should monitor. If you’re comparing tools, see how SIEM pricing compares in 2026.
Get alerted to lateral movement
Arden has detection rules for lateral movement through PsExec, pass-the-hash, WMI, RDP and DCOM, and alerts you when one of them matches.
Request a Beta Invite