{"id":70275,"date":"2025-06-12T17:51:10","date_gmt":"2025-06-12T16:51:10","guid":{"rendered":"https:\/\/www.n-able.com\/?p=70275"},"modified":"2025-09-09T18:00:16","modified_gmt":"2025-09-09T17:00:16","slug":"unravelling-cyber-defense-model-secrets-lateral-movement","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement","title":{"rendered":"Unravelling Cyber Defense Model Secrets: Lateral Movement"},"content":{"rendered":"
\n
\n

Welcome to the Unravelling Cyber Defense Model Secrets series, where we shine a light on how our Data Science team is keeping up with the latest detections.<\/em><\/p>\n

One of the most dangerous phases of an attack is lateral movement, where intruders pivot across a network to access sensitive data and high-value systems, making it hard to detect. Identifying this behavior quickly can mean the difference between a contained incident and a full-scale breach.<\/p>\n

By leveraging machine learning and advanced log analysis, security teams can uncover the subtle signs of lateral movement \u2014 even when attackers try to blend in with normal user activity.<\/p>\n

In this blog, we break down how machine learning models, fueled by logon behavior analysis, detect lateral movement. We\u2019ll also share real-world examples from customer vulnerability scans and show how the Adlumin platform helps stop attackers fast.<\/p>\n

Stopping Attackers in Their Tracks with Machine Learning<\/h2>\n

Once an attacker gains initial access to a network, they often move laterally to gain deeper access, usually in search of sensitive data and other high-value assets. This type of movement can likely be characterized by tracking a user\u2019s logon behavior over distinct periods of time, specifically through the logon events recorded in the Windows security logs (successful logon, event id 4624).<\/p>\n

These logs contain information about the type of logon that occurred, along with the time, source computer, and destination computer, which can be used to build directed graphs representing a user\u2019s logon behavior over the course of a day. These graphs can be quantified, and using machine learning, statistically anomalous logon behavior can be detected.<\/p>\n

Logon behavior gleaned from this data can also be modeled to learn the context of each access, i.e. machine-learned baselines of normal combinations of user, source host, destination machine, logon type, and time-of-day. Thereafter, the ML model can be applied to flag anomalous logons.<\/p>\n

The unique ensemble methodology involving multiple ML models sketched above is the basis for Lateral Movement detection on the platform deployed by the team \u2013 a capability often tested via penetration tests and vulnerability scans. Every week we catch pen tests or attackers doing lateral movement.<\/p>\n

From the our perspective, the most important goal is to detect indicators of scans as well as real attacks.<\/p>\n

Recent highlights include the following examples of Data Science models alerting us to the suspicious behavior that scans trigger.<\/em><\/p>\n

    \n
  • The example below is for a customer that ran a scheduled monthly vulnerability scan. Our Machine Learning model ensemble for Lateral Movement detection flagged the following logon sequence of machine access:<\/li>\n<\/ul>\n<\/div>\n<\/section>\n
    <\/span><\/span><\/div>\n
    \n
    \n
    \"\"<\/div>\n<\/div>\n<\/div>\n
    <\/span><\/span><\/div>\n
    \n
    \n

    A privileged user from the \u201ccompromised\u201d host machine accessed other machines on the network.<\/p>\n

      \n
    • The second example of Lateral Movement alert showcased below; the source device successfully logged on to another machine hosting admin shared drives:<\/li>\n<\/ul>\n<\/div>\n<\/section>\n
      <\/span><\/span><\/div>\n
      \n
      \n
      \"\"<\/div>\n<\/div>\n<\/div>\n
      <\/span><\/span><\/div>\n
      \n
      \n

      The Adlumin UEBA (User and Entity Behavior Analytics) models within the Lateral Movement detection ensemble learn \u201cnormal\u201d behavior via mathematical representation of access patterns involving users and hosts on the network. Normal behavior baselines are then used to evaluate incoming access events, and any mismatches against the baseline are raised as alerts.<\/p>\n

      The examples above emphasize the effectiveness of in-house ML detection capability and the UEBA approach: the logon sequences in both incidents are brief and appear ordinary, but machine-learned baselines can tell they are anomalous in the network\u2019s context.<\/p>\n

      Staying Ahead of Lateral Movement<\/h2>\n

      Detecting lateral movement isn\u2019t just about catching intrusions \u2014 it\u2019s about stopping attackers before they reach critical assets. By combining machine learning with detailed logon behavior analysis, the Adlumin Data Science models provide an essential line of defense, uncovering anomalies that would otherwise blend in as normal activity.<\/p>\n

      As threat tactics evolve, so must our approach to detection. With proactive monitoring and continuous improvement, we\u2019re committed to helping customers stay one step ahead of cybercriminals \u2014 building not only stronger defenses but also lasting confidence in the security of their environments.<\/p>\n<\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"

      Detect and stop lateral movement attacks with Adlumin\u2019s machine learning models, proactive monitoring, and UEBA\u2014boost your network\u2019s cybersecurity confidence.<\/p>\n","protected":false},"author":24,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-70275","post","type-post","status-publish","format-standard","hentry","topic-cyber-resilience","topic-security"],"acf":[],"yoast_head":"\nUnravelling Cyber Defense Model Secrets: Lateral Movement - N-able<\/title>\n<meta name=\"description\" content=\"Detect and stop lateral movement attacks with Adlumin\u2019s machine learning models, proactive monitoring, and UEBA\u2014boost your network\u2019s cybersecurity confidence.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Unravelling Cyber Defense Model Secrets: Lateral Movement - N-able\" \/>\n<meta property=\"og:description\" content=\"Detect and stop lateral movement attacks with Adlumin\u2019s machine learning models, proactive monitoring, and UEBA\u2014boost your network\u2019s cybersecurity confidence.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-12T16:51:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-09T17:00:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2025\/08\/2508_Adlumin_BlogHeaders_UnravellingCyberDefenseModelSecrets-LateralMovement.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"N-able\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"N-able\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement\"},\"author\":{\"name\":\"N-able\",\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b\"},\"headline\":\"Unravelling Cyber Defense Model Secrets: Lateral Movement\",\"datePublished\":\"2025-06-12T17:51:10+01:00\",\"dateModified\":\"2025-09-09T17:00:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement\"},\"wordCount\":656,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adlumin.wpenginepowered.com\/wp-content\/uploads\/data-science-blog-v3.jpg\",\"inLanguage\":\"it-IT\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement\",\"url\":\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement\",\"name\":\"Unravelling Cyber Defense Model Secrets: Lateral Movement - N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adlumin.wpenginepowered.com\/wp-content\/uploads\/data-science-blog-v3.jpg\",\"datePublished\":\"2025-06-12T17:51:10+01:00\",\"dateModified\":\"2025-09-09T17:00:16+00:00\",\"description\":\"Detect and stop lateral movement attacks with Adlumin\u2019s machine learning models, proactive monitoring, and UEBA\u2014boost your network\u2019s cybersecurity confidence.\",\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#primaryimage\",\"url\":\"https:\/\/adlumin.wpenginepowered.com\/wp-content\/uploads\/data-science-blog-v3.jpg\",\"contentUrl\":\"https:\/\/adlumin.wpenginepowered.com\/wp-content\/uploads\/data-science-blog-v3.jpg\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/it\/#website\",\"url\":\"https:\/\/www.n-able.com\/it\/\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/it\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/it\/#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/it\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b\",\"name\":\"N-able\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"caption\":\"N-able\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Unravelling Cyber Defense Model Secrets: Lateral Movement - N-able","description":"Detect and stop lateral movement attacks with Adlumin\u2019s machine learning models, proactive monitoring, and UEBA\u2014boost your network\u2019s cybersecurity confidence.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement","og_locale":"it_IT","og_type":"article","og_title":"Unravelling Cyber Defense Model Secrets: Lateral Movement - N-able","og_description":"Detect and stop lateral movement attacks with Adlumin\u2019s machine learning models, proactive monitoring, and UEBA\u2014boost your network\u2019s cybersecurity confidence.","og_url":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2025-06-12T16:51:10+00:00","article_modified_time":"2025-09-09T17:00:16+00:00","og_image":[{"width":1600,"height":900,"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2025\/08\/2508_Adlumin_BlogHeaders_UnravellingCyberDefenseModelSecrets-LateralMovement.png","type":"image\/png"}],"author":"N-able","twitter_card":"summary_large_image","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Scritto da":"N-able","Tempo di lettura stimato":"4 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement"},"author":{"name":"N-able","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b"},"headline":"Unravelling Cyber Defense Model Secrets: Lateral Movement","datePublished":"2025-06-12T17:51:10+01:00","dateModified":"2025-09-09T17:00:16+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement"},"wordCount":656,"publisher":{"@id":"https:\/\/www.n-able.com\/it\/#organization"},"image":{"@id":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#primaryimage"},"thumbnailUrl":"https:\/\/adlumin.wpenginepowered.com\/wp-content\/uploads\/data-science-blog-v3.jpg","inLanguage":"it-IT"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement","url":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement","name":"Unravelling Cyber Defense Model Secrets: Lateral Movement - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/it\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#primaryimage"},"image":{"@id":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#primaryimage"},"thumbnailUrl":"https:\/\/adlumin.wpenginepowered.com\/wp-content\/uploads\/data-science-blog-v3.jpg","datePublished":"2025-06-12T17:51:10+01:00","dateModified":"2025-09-09T17:00:16+00:00","description":"Detect and stop lateral movement attacks with Adlumin\u2019s machine learning models, proactive monitoring, and UEBA\u2014boost your network\u2019s cybersecurity confidence.","inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.n-able.com\/it\/blog\/unravelling-cyber-defense-model-secrets-lateral-movement#primaryimage","url":"https:\/\/adlumin.wpenginepowered.com\/wp-content\/uploads\/data-science-blog-v3.jpg","contentUrl":"https:\/\/adlumin.wpenginepowered.com\/wp-content\/uploads\/data-science-blog-v3.jpg"},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/it\/#website","url":"https:\/\/www.n-able.com\/it\/","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/it\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/it\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/it\/#organization","name":"N-able","url":"https:\/\/www.n-able.com\/it\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b","name":"N-able","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","caption":"N-able"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts\/70275","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/comments?post=70275"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts\/70275\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/media?parent=70275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}