Adding Lateral Movement, Network Traffic and Config Change Identification | Voters

Adding Lateral Movement, Network Traffic and Config Change Identification

in progress

Chris Bisnett

Adding in the ability to identify lateral movement using RDP, PsExec, or SMB, track network traffic metadata to ascertain if 2 IP addresses have communicated and analyze Firewall log data to identify potentially malicious configuration changes.

Created by James Mason | SE @ Huntress

February 24, 2025

Nate O'Brien

marked this post as

in progress

We've developed several detections around network traffic and lateral movement and are continuing to grow our detection catalog.

Ruben Castello

Nate O'Brien Hello Nate, this network detections will be integrated in the EDR Agent in future releases?

Nate O'Brien

marked this post as

planned

James Mason | SE @ Huntress

marked this post as

future planned