Nothing about it
looks like an attack.
Lateral movement is normal protocols, normal ports, normal credentials, between machines that were always allowed to talk. That is what makes it hard, and it is also what makes the network the only place to see it.
Lateral movement is an attacker moving between hosts inside a network using legitimate protocols and, usually, legitimate credentials. There is rarely anything malformed to detect — the signal is relational: a pair of hosts that never spoke before, an account authenticating somewhere it never has, administrative protocols at hours nobody works. Finding it is a baselining problem, and proving it is a retention problem. Net-Monitor contributes the second and part of the first: a learned baseline of who normally talks to whom, and the retained packets to establish what actually happened.
Six patterns on the wire.
Each is unremarkable on its own. The signal is that it is new for that host, in that direction, at that hour.
A peer pair that has no history
Two workstations that have never exchanged a packet suddenly do. Nothing about the traffic is malformed. The only thing wrong with it is that it has never happened before.
Requires a baseline of normal peer relationships per host — which requires having watched for long enough to have one.
Administrative protocols in the wrong direction
SMB, RDP, WinRM and SSH are how the estate is managed. Between two endpoints rather than from a management subnet, they are something else.
The direction and the subnet matter more than the protocol. A rule about the protocol alone produces noise.
One host reaching many, briefly
Discovery looks like a fan-out: one source touching many destinations in a short window, mostly with short or failed connections.
Look for a spike in distinct destinations per source, not in volume. The volume is usually tiny.
Failed connections that nobody counts
Enumeration produces refusals and resets in numbers that would be odd for legitimate software. Successes get logged; failures often do not.
The ratio of failed to successful connections per host is a strong and under-used signal.
Timing that does not match a person
Traffic patterned to the second, or activity from a workstation at 03:00 on a Sunday. Humans are irregular; automation is not.
Regularity is easier to see over weeks than over hours, which is another argument for retention.
East-west, where nobody is watching
Most instrumentation faces the perimeter. Server-to-server traffic inside the estate is usually the largest volume on the network and the least observed — which is precisely why movement happens there.
If capture points only cover the edge, this entire category is invisible regardless of what tooling you own.
Four steps, and one that has to happen first.
- 1
Establish the normal peer graph
Who talks to whom, on what, at what hours. This is the reference everything else is measured against, and it cannot be produced retroactively.
- 2
Watch for new relationships, not new traffic
Volume is the wrong metric here. A new pairing carrying 40 KB matters more than a familiar pairing carrying 40 GB.
- 3
Cover east-west, not just the perimeter
Place capture where internal traffic actually crosses. Movement between two hosts on the same segment is invisible to an edge sensor.
- 4
When something is flagged, go to the packets
A baseline says a relationship is unusual. Only the retained traffic says what was carried, in which direction, and whether it succeeded.
What Net-Monitor contributes here
- A learned baseline of peer relationships. New pairings, unusual directions and off-hours activity are departures from your own normal rather than matches against a rule.
- The retained traffic behind any flag. This is the part most stacks lack: when something is raised, the packets that show what was actually carried already exist.
- Coverage of east-west paths. Capture placed where internal traffic crosses, not only at the perimeter.
- No signatures, and no claim to have them. This will not name a technique or map it to a framework. It will show you a relationship that has never existed before, and the traffic that went across it.
Short answers.
How do you detect lateral movement in network traffic?
By relationship rather than by content. The reliable signals are a host pair with no prior history, administrative protocols in an unusual direction, one source touching many destinations briefly, an abnormal ratio of failed connections, and timing too regular to be a person. All of them require knowing what that host normally does, which means having observed it beforehand.
Does Net-Monitor identify specific attack techniques?
No. There is no signature library and no mapping to a technique framework, so it will not tell you "this is technique X". It flags that a relationship or a pattern is a departure from your network's learned normal, and it holds the traffic so that a human — or your detection tooling — can determine what it was.
Can lateral movement be seen if the traffic is encrypted?
Largely yes. Encryption hides the payload, not the relationship. Which hosts talked, when, how often, in which direction, how much, and whether the connection succeeded are all visible, and those are the fields the patterns above are built from.
Why is east-west coverage such a common gap?
Because instrumentation tends to follow the perimeter, where the perceived threat is. Internal server-to-server traffic is usually the largest volume on the network and the least monitored, so movement between two internal hosts crosses no sensor at all.
Related questions.
Do you know what normally talks to what?
Most estates do not, and building that picture is usually the first genuinely useful thing a deployment produces.