Use Case

Lateral movement detection before attackers reach crown jewels

Q: Do we need a separate NDR product?

VORXOC correlates the telemetry you already connect. Strong network visibility helps, but the value is in joining network signals with identity and endpoint context.

Q: How is this different from malware detection?

Malware detection focuses on malicious code and host behavior. Lateral movement detection focuses on how an attacker (or their tools) travels between systems after foothold.

Q: Can containment avoid breaking production admin workflows?

Yes. Response policies and approval gates let you isolate high-risk hops aggressively while keeping known admin patterns under tighter review.

Catch attackers moving east-west through your network, including remote execution, credential reuse, and unusual host-to-host paths, before they pivot to critical systems.

Book a Demo

Explore VORXOC

Lateral movement detection, bidirectional arrows in a glowing hexagonal hub

Use CasesLateral Movement Detection

Network
Behavioral
Correlation

Detect lateral movement before attackers reach crown jewels. VORXOC correlates east-west activity across identity, endpoint, and network for early containment.

VORXOC pipeline

How VORXOC turns host logs into a lateral-movement incident

East-west hops across devices become a single attack path instead of scattered admin-looking events.

01
Log ingestion from any device
Authentication, EDR, and network telemetry from workstations, jump boxes, and servers feed the same pipeline so hops are visible end to end.
- EDR
- Domain / IdP auth
- VPN / ZTNA
- Firewall / NDR
- Server logs
First-seen host pairs and remote execution tools are retained with full context.
02
Log mapping
RDP, SMB, WinRM, and cloud SSM-style sessions map into a common “remote access” model so movement is comparable across OS and cloud.
src_host / ComputerNamehost.source
dst_host / Destinationhost.target
logon_type / protocolauth.method
account / TargetUseruser.id
Mapped hops become edges in the movement graph used for correlation.
03
Event correlation
Unusual remote execution, credential reuse, and first-time host pairs chain into a path toward crown-jewel systems.
- Auth: WS-FIN-12 → JUMP-01 via RDP (rare pair)
- EDR: PsExec-like remote process on JUMP-01
- Auth: credential hash replayed on FS-SHARE (pass-the-hash)
- Network: attempt toward DC-01 blocked mid-path
The graph updates as new hops arrive so containment targets the right intermediate host.
04
Incident generation
VORXOC generates a lateral-movement incident with the hop path, suspected credentials, and next-likely targets prioritized.
INC-LM-2208Critical
Lateral movement path toward domain services
3 hops mapped · credential reuse · DC pivot interrupted
Isolation and credential invalidation attach to the same incident for rapid containment.

Live detection view

Attack hop path across the estate

East-west progression reconstructed in one incident

The path is interrupted before domain controller access succeeds.

Perimeter alerts miss the middle of the attack

After initial access, attackers rarely stay on the beachhead. They reuse credentials, abuse remote management tools, and hop between hosts looking for domain admins and valuable data. North-south firewall alerts and single-host EDR detections often miss that east-west progression until something critical is touched.

Each hop may look allowed in isolation (admin tools, SMB, RDP, cloud APIs), so teams need correlation across identity, endpoint, and network to see the path as an attack chain rather than unrelated events.

East-west movement hides inside legitimate admin protocols
Single-tool alerts rarely reconstruct the full hop path
Credential reuse links hosts that never shared an obvious malware family
Late detection means crown jewels are already in scope

How VORXOC detects lateral movement

VORXOC stitches authentication, endpoint, and network telemetry into a movement graph: unusual remote execution, first-time host pairs, privilege escalation, and credential spray across systems.

When a path looks like attacker progression, response can isolate intermediate hosts, invalidate stolen credentials, and prioritize the crown-jewel assets in the predicted path, while giving analysts a single narrative of how the attacker moved.

Cross-source correlation of auth, endpoint, and network hops
Behavioral detection of unusual remote execution and admin tool abuse
Containment that interrupts the path, not just the first host
Clear attack-path timelines for faster investigation

Lateral movement after ransomware or phishing

Lateral movement is the bridge between initial access (phishing, malware) and impact (ransomware, exfiltration). Detecting that bridge early is often the difference between a contained endpoint incident and an enterprise-wide crisis. Pair this use case with malware/ransomware and account compromise pages for the full kill-chain view.

East-westDetection focushost-to-host and credential reuse paths

Multi-sourceCorrelationidentity + endpoint + network

Pre-pivotGoalstop movement before crown jewels

Why teams run this use case on VORXOC

Cross-source correlation of auth, endpoint, and network hops
Behavioral detection of unusual remote execution and admin tool abuse
Containment that interrupts the path, not just the first host
Clear attack-path timelines for faster investigation

Frequently Asked Questions

What counts as lateral movement?

Any attacker progression from an initially compromised system to other hosts or privileges, including RDP, SMB, remote tools, cloud APIs, or stolen credentials.

Do we need a separate NDR product?

How is this different from malware detection?

Can containment avoid breaking production admin workflows?

More threat use cases

Malware & Ransomware

Identify malicious code before it executes and stop encryption activity before it becomes a business-stopping outage.

View use case

Account Compromise

Catch stolen credentials and impossible-travel logins the moment they appear, before attackers pivot into email, cloud apps, and privileged systems.

View use case

Insider Threat Detection

Monitor risky behavior from trusted users, whether intentional or accidental, and give analysts clear investigation paths instead of endless anomaly noise.

View use case